Threats tagged 'ghsa-38xh-8h9r-v3mm'

The svg-sanitizer library versions from 0.11.0 up to but not including 1.1.0 contain an algorithmic complexity denial of service (DoS) vulnerability. This flaw exists in the hasInfiniteLoop() and countUse() functions of the use reference-graph analysis. An attacker can exploit this by uploading a crafted SVG file with 15 levels of fanned-out use elements, causing exponential path enumeration that can tie up PHP workers for extended periods.