svg-sanitizer: Denial of service via regex complexity (CVE-2026-117540)
The svg-sanitizer library, versions 0.5.3 through 1.0.x, contains a denial-of-service vulnerability in the Sanitizer::sanitize method that allows unauthenticated attackers to exhaust CPU resources via crafted SVG files.
CVE search metadata
CVE search record: CVE-2026-117540. Severity: high. CVSS: 7.5. KEV: no. Product: svg-sanitizer (>= 0.5.3, < 1.1.0). Brief: svg-sanitizer: Denial of service via regex complexity (CVE-2026-117540). Brief link: https://feed.craftedsignal.io/briefs/2026-10-svg-sanitizer-dos/
Triage facts
Revision 1- Applicability
- svg-sanitizer (>= 0.5.3, < 1.1.0)
- Evidence
- Unknown
- Severity
- Low
- Action
- Elevated
- Sources
- 1 public source
- Freshness
- Revision 1Oct 27, 11:47 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A1Likely
A denial of service vulnerability exists in the svg-sanitizer library (versions 0.5.3 up to 1.1.0). The Sanitizer::sanitize() method performs inefficient regex processing when stripping PHP tags from input. By providing a specially crafted SVG file containing a high density of overlapping PHP tag openers and closers, an attacker can trigger quadratic complexity in the preg_replace function. This results in prolonged CPU usage, potentially leading to service exhaustion for applications relying on the library for SVG processing.
Impact
Successful exploitation allows unauthenticated attackers to trigger sustained, high CPU utilization on the server processing the SVG input, leading to service disruption or denial of service.
Recommendation
Upgrade the svg-sanitizer library to version 1.1.0 or later immediately to incorporate the fix for regex complexity. If immediate patching is not possible, implement strict file size and complexity limits for uploaded SVG files as an interim mitigation.
Immediate actions
Upgrade svg-sanitizer library to version 1.1.0 or later
Threat Hunt
Identify and analyze application logs for abnormal PHP processing duration or excessive CPU usage spikes linked to SVG upload endpoints.
Data: Web server access logs, Application performance monitoring (APM) logs
Mitigations
Implement request size limits and validation for file uploads to mitigate potential DoS vectors
CVE-2026-117540