CVE-2026-117540 - svg-sanitizer before 1.1.0 Quadratic CPU-Exhaustion DoS via PHP-Tag Stripping Loop
CVE ID :CVE-2026-117540 Published : Oct. 27, 2026, 11:17 a.m. | 1 hour, 6 minutes ago Description :svg-sanitizer from 0.5.3 before 1.1.0 contains a denial of service vulnerability in Sanitizer::sanitize() that repeatedly rescans the whole input while stripping PHP tags. Unauthenticated...