Inefficient Algorithmic Complexity in SVG Sanitizer - #VU159648
Published: November 6, 2026
Vulnerability identifier: #VU159648
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-407
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an unauthenticated remote attacker to cause CPU-exhaustion denial of service in applications using SVG Sanitizer.
The vulnerability exists due to quadratic processing in the default PHP-tag stripping loop, which repeatedly scans the entire input before XML parsing when overlapping PHP tags are supplied. An unauthenticated remote attacker can submit crafted SVG uploads without user interaction to occupy workers for tens of seconds and exhaust the worker pool through concurrent requests.
Affected software
SVG Sanitizer
Remediation
Install security update from vendor's website.
SVG Sanitizer - update to 1.1.0