Live › vulnerability › CVE-2026-121444
svg-sanitizer, a PHP library for cleaning SVG uploads, takes exponential time on a small crafted SVG with layered use elements. An attacker who can upload a file can tie up PHP workers for hours, causing denial of service.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 15:22 UTC. All times on this page are UTC.
Applications that pass user-uploaded SVG files through svg-sanitizer on PHP workers are exposed, because the crafted input is processed during the upload. Systems that never accept SVG uploads, or that do not run this library on untrusted input, can skip it.
No product ranges from the sources yet.
svg-sanitizer in composer.lock or composer show svg-sanitizer0.11.0 and 1.1.0 (before 1.1.0)svg-sanitizer or later1.1.0Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
svg-sanitizer from 0.11.0 before 1.1.0 contains an algorithmic complexity denial of service vulnerability in hasInfiniteLoop() and countUse() of the use reference-graph analysis. Attackers can upload a small layered SVG with 15 levels of fanned-out use elements, forcing exponential path enumeration that pins PHP workers for hours.
This page as .md · .json · in your agent: get_signal("CVE-2026-121444")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.