CVE-2026-121444: svg-sanitizer 0.11.0 before 1.1.0 Algorithmic Complexity DoS via use Reference Graph

Published Nov 3, 2026

Updated

svg-sanitizer from 0.11.0 before 1.1.0 contains an algorithmic complexity denial of service vulnerability in hasInfiniteLoop() and countUse() of the use reference-graph analysis. Attackers can upload a small layered SVG with 15 levels of fanned-out use elements, forcing exponential path enumeration that pins PHP workers for hours.

Event History

Nov 3, 2026

CVE Published

via MITRE·02:28 PM

Data Sourced

via MITRE·02:28 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·03:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who is exposed to this denial-of-service issue?

Applications using svg-sanitizer versions from 0.11.0 before 1.1.0 are exposed if an attacker can upload or submit SVG content for sanitization. No authentication or user interaction is required according to the supplied vector.

What kind of SVG triggers the resource exhaustion?

A small layered SVG containing 15 levels of fanned-out use elements can trigger exponential path enumeration in the use reference-graph analysis. This can pin PHP workers for hours.

Which code paths are implicated?

The issue is in the hasInfiniteLoop() and countUse() functions used for use reference-graph analysis.

CVE-2026-121444: svg-sanitizer 0.11.0 before 1.1.0 Algorithmic Complexity DoS via use Reference Graph

Event History

Frequently Asked Questions

Who is exposed to this denial-of-service issue?

What kind of SVG triggers the resource exhaustion?

Which code paths are implicated?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this denial-of-service issue?

What kind of SVG triggers the resource exhaustion?

Which code paths are implicated?