CVE-2026-121444

    Dashboard / Vulnerabilities / CVE-2026-121444

    CVE-2026-121444

    Published: 3 Nov 2026Last Modified: 5 Nov 2026

    Summary: svg-sanitizer 0.11.0 before 1.1.0 Algorithmic Complexity DoS via use Reference Graph

    Details: svg-sanitizer from 0.11.0 before 1.1.0 contains an algorithmic complexity denial of service vulnerability in hasInfiniteLoop() and countUse() of the use reference-graph analysis. Attackers can upload a small layered SVG with 15 levels of fanned-out use elements, forcing exponential path enumeration that pins PHP workers for hours.

    References: https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/121xxx/CVE-2026-121444.json, https://github.com/darylldoyle/svg-sanitizer/security/advisories/GHSA-hrwm-vcc9-hcm4, https://nvd.nist.gov/vuln/detail/CVE-2026-121444, https://www.vulncheck.com/advisories/svg-sanitizer-0.11.0-before-1.1.0-algorithmic-complexity-dos-via-use-reference-graph

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 38767c14d1d36cc1929bd86f48a105c19f518178
    Fixed -9ba9001493f5da737759303f13bd965ebdaa778c

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2026-121444 | CVE-DB