Inefficient regular expression complexity in SVG Sanitizer - #VU159651
Published: November 6, 2026
Vulnerability identifier: #VU159651
CSH Severity: Medium
CVSS v4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-1333
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an unauthenticated remote attacker to exhaust CPU resources and deny service to applications processing untrusted SVG files.
The vulnerability exists due to super-linear matching in SVG Sanitizer's CSS image-set regular expression when remote reference removal is enabled through removeRemoteReferences(true) and CSS contains repeated unterminated image-set tokens. An unauthenticated remote attacker can submit a crafted SVG under one megabyte to occupy a processing worker for tens of seconds.
Affected software
SVG Sanitizer
Remediation
Install security update from vendor's website.
SVG Sanitizer - update to 1.1.0