CVE-2026-121444 Details
Description
svg-sanitizer from 0.11.0 before 1.1.0 contains an algorithmic complexity denial of service vulnerability in hasInfiniteLoop() and countUse() of the use reference-graph analysis. Attackers can upload a small layered SVG with 15 levels of fanned-out use elements, forcing exponential path enumeration that pins PHP workers for hours.
A denial-of-service vulnerability has been identified in svg-sanitizer versions 0.11.0 prior to 1.1.0. This vulnerability arises from algorithmic complexity issues in the 'hasInfiniteLoop()' and 'countUse()' functions, which analyze the reference graph of 'use' elements. Attackers can exploit this vulnerability by uploading a small, layered SVG file containing 15 levels of fanned-out 'use' elements. This manipulation forces an exponential enumeration of paths, causing PHP workers to be tied up for hours.
Users are advised to update to svg-sanitizer version 1.1.0 or later.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Nov 3, 2026CISA-ADP
Assessed Nov 3, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-400 | Uncontrolled Resource Consumption | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| enshrined/svg-sanitize | >= 0.11.0, <= 1.0.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 3, 2026 | CVE Modified | CISA-ADP |
| Nov 3, 2026 | New CVE Received | [email protected] |