svg-sanitizer EUVD-2026-115866

The target application must accept attacker-supplied SVG and process it through svg-sanitizer's Sanitizer::sanitize() (the costly walk runs during Resolver::collect(), before any <use> element is removed); no non-default configuration is required - the advisory confirms the behavior on default settings. The attacker crafts an acyclic layered DAG of exactly <=15 <use> nesting levels so the useNestingLimit=15 DEPTH guard (which bounds depth, not total work) never fires. Limiting factors: exploitation is bounded by PHP max_execution_time on web SAPIs (worker freed at the limit) but is effectively unbounded under CLI or queue/background workers; and real-world reach depends on whether the SVG-ingest path is exposed to unauthenticated users. Affected only on svg-sanitizer >= 0.11.0 and <= 1.0.0.

This is a genuine availability risk but not an emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) with VA:H and a score of 8.7 is consistent with the GHSA evidence: a single ~4-12 KB SVG passed to Sanitizer::sanitize() forces super-polynomial (~k^depth) CPU in the unmemoized hasInfiniteLoop()/countUse() reference-graph walk, measured at ~1.3 s for a 4 KB file and extrapolated to ~28 CPU-hours for buildSvg(15,6). Impact is strictly availability - confidentiality and integrity are untouched (VC:N/VI:N) - so despite the high score this is a resource-exhaustion issue, not RCE or data compromise. The vuln.today Decision label is 'this_week' (not act_now/emergency), and there is no CISA KEV listing and no EPSS score in the supplied data, so there is no evidence of active exploitation; the priority rests on how easy and cheap the attack is (tiny input, no auth required per PR:N, confirmed on default settings) rather than on observed in-the-wild use. One caveat: the CVSS assigns PR:N, but real-world exploitability depends on whether the application accepts SVG from unauthenticated users or only from authenticated/privileged ones - verify the deployment's upload path. Worst case is severe under CLI/queue workers where no max_execution_time bounds the walk.

An attacker submits a ~12 KB SVG containing 15 layers of fanned-out <use> elements (every node's 6 <use> children point at all nodes in the next layer) to any endpoint that sanitizes user-supplied SVGs with svg-sanitizer. During Resolver::collect(), hasInfiniteLoop() enumerates ~7.84e10 root-to-leaf paths, consuming tens of CPU-hours and pinning a PHP worker until max_execution_time - or indefinitely under CLI/queue workers. A working generator and measured scaling data are published in the GHSA advisory, so a reproducible public PoC reference exists, though the input does not flag it as a verified weaponized exploit.