Loofah versions prior to 2.25.3 contain a regular expression denial of service (ReDoS) vulnerability in the SVG local-reference check. The vulnerability arises from a regexp pattern that causes quadratic-time processing on inputs with long runs of whitespace in the href or xlink:href attributes of SVG reference elements. This affects Ruby 3.1 and earlier, as Ruby 3.2 introduced linear-time regexp matching that mitigates the issue. An attacker can cause excessive CPU consumption by supplying malicious HTML with crafted SVG references. The issue is fixed in Loofah 2.25.3.