GHSA-2v7c-jx29-jprp: svg-sanitizer before 1.1.0 Quadratic CPU-Exhaustion DoS via PHP-Tag Stripping Loop

Published Oct 27, 2026

Updated

svg-sanitizer from 0.5.3 before 1.1.0 contains a denial of service vulnerability in Sanitizer::sanitize() that repeatedly rescans the whole input while stripping PHP tags. Unauthenticated attackers can upload SVGs with many overlapping PHP tag openers and closers, forcing quadratic pregreplace passes that exhaust worker CPU for minutes.

Event History

Oct 27, 2026

CVE Published

via OSV·10:59 AM

Data Sourced

via OSV·10:59 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed to this denial-of-service condition?

Deployments using svg-sanitizer versions from 0.5.3 before 1.1.0 are affected when untrusted users can submit SVG content that is passed to Sanitizer::sanitize(). The impact is worker CPU exhaustion rather than compromise of confidentiality or integrity.

What does an attacker need to exploit it?

An attacker needs no authentication or user interaction. They need a way to upload or otherwise provide a crafted SVG containing many overlapping PHP tag openers and closers for sanitization.

Are default protections sufficient to prevent exploitation?

The available information does not identify any configuration-based protection. Exposure depends on whether attacker-controlled SVGs reach the vulnerable sanitization method.

What can be done before upgrading?

If upgrading is not immediately possible, prevent untrusted SVGs from being submitted to the sanitizer or reject SVG inputs containing PHP tag openers and closers before sanitization. Apply resource limits to sanitization workers to reduce the effect of CPU exhaustion.

How can defenders identify attempted exploitation?

Look for sanitizer requests handling SVGs with numerous overlapping PHP tag openers and closers, especially requests correlated with prolonged worker CPU use or sanitization taking minutes.

GHSA-2v7c-jx29-jprp: svg-sanitizer before 1.1.0 Quadratic CPU-Exhaustion DoS via PHP-Tag Stripping Loop

Event History

Frequently Asked Questions

Which deployments are exposed to this denial-of-service condition?

What does an attacker need to exploit it?

Are default protections sufficient to prevent exploitation?

What can be done before upgrading?

How can defenders identify attempted exploitation?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this denial-of-service condition?

What does an attacker need to exploit it?

Are default protections sufficient to prevent exploitation?

What can be done before upgrading?

How can defenders identify attempted exploitation?