Inefficient Algorithmic Complexity in SVG Sanitizer - #VU159650
Published: November 6, 2026
Vulnerability identifier: #VU159650
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-407
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an unauthenticated remote attacker to exhaust CPU resources and deny service to applications using SVG Sanitizer.
The vulnerability exists due to exponential path traversal in SVG Sanitizer's reference-graph analysis when layered, acyclic <use> references remain within the nesting limit but repeatedly traverse shared nodes. An unauthenticated remote attacker can submit a small crafted SVG for sanitization under default settings, causing excessive processing that occupies a PHP worker.
Affected software
SVG Sanitizer
Remediation
Install security update from vendor's website.
SVG Sanitizer - update to 1.1.0