Cpe:2.3:a:svg-Sanitizer:svg-Sanitizer:*:*:*:*:*:*:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3asvg-sanitizersvg-sanitizer/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioTue, 27 Oct 2026 11:47:03 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgsvg-sanitizer: Denial of service via regex complexity (CVE-2026-117540)https://feed.craftedsignal.io/briefs/2026-10-svg-sanitizer-dos/Tue, 27 Oct 2026 11:47:03 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-svg-sanitizer-dos/The svg-sanitizer library, versions 0.5.3 through 1.0.x, contains a denial-of-service vulnerability in the Sanitizer::sanitize method that allows unauthenticated attackers to exhaust CPU resources via crafted SVG files.A denial of service vulnerability exists in the svg-sanitizer library (versions 0.5.3 up to 1.1.0). The Sanitizer::sanitize() method performs inefficient regex processing when stripping PHP tags from input. By providing a specially crafted SVG file containing a high density of overlapping PHP tag openers and closers, an attacker can trigger quadratic complexity in the preg_replace function. This results in prolonged CPU usage, potentially leading to service exhaustion for applications relying on the library for SVG processing.

Impact

Successful exploitation allows unauthenticated attackers to trigger sustained, high CPU utilization on the server processing the SVG input, leading to service disruption or denial of service.

Recommendation

Upgrade the svg-sanitizer library to version 1.1.0 or later immediately to incorporate the fix for regex complexity. If immediate patching is not possible, implement strict file size and complexity limits for uploaded SVG files as an interim mitigation.

]]>lowadvisory