GHSA-hrwm-vcc9-hcm4: svg-sanitizer 0.11.0 before 1.1.0 Algorithmic Complexity DoS via use Reference Graph
svg-sanitizer from 0.11.0 before 1.1.0 contains an algorithmic complexity denial of service vulnerability in hasInfiniteLoop() and countUse() of the use reference-graph analysis. Attackers can upload a small layered SVG with 15 levels of fanned-out use elements, forcing exponential path enumeration that pins PHP workers for hours.
Event History
Frequently Asked Questions
Which deployments are exposed to this denial of service?
Deployments using svg-sanitizer versions from 0.11.0 up to, but not including, 1.1.0 are affected when an attacker can upload or otherwise submit SVG content for sanitization. The attack can be performed remotely without privileges or user interaction.
What does an attacker need to submit to trigger the issue?
The attacker needs to provide a small layered SVG containing 15 levels of fanned-out use elements. Processing this structure causes exponential path enumeration in the use reference-graph analysis and can pin PHP workers for hours.
How can I determine whether my service may already be affected?
Check whether the application uses an affected svg-sanitizer version and accepts SVGs from untrusted sources. PHP workers that remain busy for unusually long periods while sanitizing SVG uploads may indicate attempted exploitation.