{"id":"CVE-2026-121444","published":"2026-11-03T15:17:36.443","lastModified":"2026-11-03T19:18:03.523","description":"svg-sanitizer from 0.11.0 before 1.1.0 contains an algorithmic complexity denial of service vulnerability in hasInfiniteLoop() and countUse() of the use reference-graph analysis. Attackers can upload a small layered SVG with 15 levels of fanned-out use elements, forcing exponential path enumeration that pins PHP workers for hours.","cvssScore":7.5,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwes":["CWE-400"],"vendors":[],"products":[],"references":[{"url":"https://github.com/darylldoyle/svg-sanitizer/security/advisories/GHSA-hrwm-vcc9-hcm4","tags":[]},{"url":"https://www.vulncheck.com/advisories/svg-sanitizer-0.11.0-before-1.1.0-algorithmic-complexity-dos-via-use-reference-graph","tags":[]}],"exploitRefs":[{"url":"https://github.com/darylldoyle/svg-sanitizer/security/advisories/GHSA-hrwm-vcc9-hcm4","tags":[]}],"hasPoc":true,"ai":null}