CVE-2026-128068

rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. From 1.0.3 through 1.7.1, Rails::HTML::PermitScrubber checks SVG href and xlink:href local references with a pattern whose line-start anchor and whitespace class cause an all-whitespace value to be rescanned...

CVE-2026-128068 rails-html-sanitizer: Possible regular expression denial of service with certain configurations

rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. From 1.0.3 through 1.7.1, Rails::HTML::PermitScrubber checks SVG href and xlink:href local references with a pattern whose line-start anchor and whitespace class cause an all-whitespace value to be rescanned...

EUVD-2026-125592

rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. From 1.0.3 through 1.7.1, Rails::HTML::PermitScrubber checks SVG href and xlink:href local references with a pattern whose line-start anchor and whitespace class cause an all-whitespace value to be rescanned...

CVE-2026-128068

The rails-html-sanitizer library (versions 1.0.3 through 1.7.1) is vulnerable to a Regular Expression Denial of Service (ReDoS) . The root cause lies in the Rails::HTML::PermitScrubber component, where a pattern used to check SVG href and xlink:href local references causes all-whitespace values t...

CVE-2026-126366

MessagePack for Ruby is an implementation of the MessagePack binary serialization format. Prior to 1.8.7, the Java-platform msgpack gem for JRuby allocated arrays and byte buffers directly from attacker-controlled array32, str32, and bin32 declared sizes before confirming that corresponding...

CVE-2026-126366: msgpack msgpack-ruby: MessagePack for Ruby is an implementation of the MessagePack binary serialization format

MessagePack for Ruby is an implementation of the MessagePack binary serialization format. Prior to 1.8.7, the Java-platform msgpack gem for JRuby allocated arrays and byte buffers directly from attacker-controlled array32, str32, and bin32 declared sizes before confirming that corresponding...

GHSA-73V3-WF97-VPGJ msgpack-ruby JRuby decoder makes uncapped header-count allocations; a 5-byte message forces multi-GiB OOM

Summary The JRuby implementation of msgpack msgpack gem, java platform — pure Java decoder under ext/java/ sizes containers directly from the element count written in the message header, with no cap at all: no equivalent of the C unpacker's SHRTMAX clamp since 1.7.3 and none of the buffered-bytes...

msgpack-ruby JRuby decoder makes uncapped header-count allocations; a 5-byte message forces multi-GiB OOM

Summary The JRuby implementation of msgpack msgpack gem, java platform — pure Java decoder under ext/java/ sizes containers directly from the element count written in the message header, with no cap at all: no equivalent of the C unpacker's SHRTMAX clamp since 1.7.3 and none of the buffered-bytes...

CVE-2026-126366 msgpack-java JRuby decoder allocates from declared header counts with no cap: 5-byte message forces multi-GiB OOM

MessagePack for Ruby is an implementation of the MessagePack binary serialization format. Prior to 1.8.7, the Java-platform msgpack gem for JRuby allocated arrays and byte buffers directly from attacker-controlled array32, str32, and bin32 declared sizes before confirming that corresponding...

CVE-2026-126366

MessagePack for Ruby is an implementation of the MessagePack binary serialization format. Prior to 1.8.7, the Java-platform msgpack gem for JRuby allocated arrays and byte buffers directly from attacker-controlled array32, str32, and bin32 declared sizes before confirming that corresponding...

CVE-2026-126366 msgpack-java JRuby decoder allocates from declared header counts with no cap: 5-byte message forces multi-GiB OOM

MessagePack for Ruby is an implementation of the MessagePack binary serialization format. Prior to 1.8.7, the Java-platform msgpack gem for JRuby allocated arrays and byte buffers directly from attacker-controlled array32, str32, and bin32 declared sizes before confirming that corresponding...

CVE-2026-126366

The msgpack-ruby gem for the JRuby platform (versions prior to 1.8.7 ) is vulnerable to a memory exhaustion issue. The msgpack-java decoder incorrectly allocates arrays and byte buffers based on attacker-controlled sizes provided in array32 , str32 , and bin32 headers without verifying the availa...

CVE-2026-126350

Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard library. From 2.3.0 until 2.9.1, URI template expressions using the explode modifier with the slash, dot, semicolon, question-mark, or ampersand operators generate ambiguous regular expressions...

CVE-2026-126352

Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard library. From 2.3.0 until 2.9.1, URI templates with several variables in one expression or several adjacent expressions generate ambiguous regular expressions. Affected forms include...

CVE-2026-126352 Addressable: Regular Expression Denial of Service in Addressable templates with multiple variables

Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard library. From 2.3.0 until 2.9.1, URI templates with several variables in one expression or several adjacent expressions generate ambiguous regular expressions. Affected forms include...

CVE-2026-126352

The Addressable Ruby gem (versions 2.3.0 through 2.9.1) is vulnerable to a Regular Expression Denial of Service (ReDoS) . The root cause is that URI templates containing multiple variables in a single expression or adjacent expressions generate ambiguous regular expressions. Specifically, Templat...

CVE-2026-126350 Addressable: Regular Expression Denial of Service in Addressable templates with certain exploded expressions

Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard library. From 2.3.0 until 2.9.1, URI template expressions using the explode modifier with the slash, dot, semicolon, question-mark, or ampersand operators generate ambiguous regular expressions...

CVE-2026-126350

Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard library. From 2.3.0 until 2.9.1, URI template expressions using the explode modifier with the slash, dot, semicolon, question-mark, or ampersand operators generate ambiguous regular expressions...

CVE-2026-126350

The Addressable library (an alternative to Ruby's standard URI implementation) is vulnerable to a Regular Expression Denial of Service (ReDoS) . In versions 2.3.0 until 2.9.1 , URI template expressions using the explode modifier with slash, dot, semicolon, question-mark, or ampersand operators ge...

CVE-2026-126205

Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. Prior to 2.25.3, the Loofah HTML5 sanitizer checks href and xlink:href on elements in SVGALLOWLOCALHREF with a regular expression whose line anchor and newline-matching...