CVE-2026-107381

svg-sanitizer is a PHP SVG/XML sanitizer. Prior to 1.0.0, Resolver::processReferences in src/ElementReference/Resolver.php builds the SVG reference graph with a case-sensitive href attribute predicate before cleanHrefAttributes normalizes mixed-case names. An attacker can provide xlink:HrEf on...

CVE-2026-107381 svg-sanitizer: Mixed-case xlink:HrEf skips the `<use>` nesting-DoS check in Resolver::processReferences

svg-sanitizer is a PHP SVG/XML sanitizer. Prior to 1.0.0, Resolver::processReferences in src/ElementReference/Resolver.php builds the SVG reference graph with a case-sensitive href attribute predicate before cleanHrefAttributes normalizes mixed-case names. An attacker can provide xlink:HrEf on...

CVE-2026-107381

The svg-sanitizer PHP library is vulnerable to a Denial of Service (DoS) attack due to a case-sensitivity mismatch in how it processes SVG elements. Prior to version 1.0.0 , the Resolver::processReferences() function uses a case-sensitive XPath predicate to build the reference graph. An attacker...

CVE-2026-107381 svg-sanitizer: Mixed-case xlink:HrEf skips the `<use>` nesting-DoS check in Resolver::processReferences

svg-sanitizer is a PHP SVG/XML sanitizer. Prior to 1.0.0, Resolver::processReferences in src/ElementReference/Resolver.php builds the SVG reference graph with a case-sensitive href attribute predicate before cleanHrefAttributes normalizes mixed-case names. An attacker can provide xlink:HrEf on...

CVE-2026-107381 svg-sanitizer: Mixed-case xlink:HrEf skips the `<use>` nesting-DoS check in Resolver::processReferences

svg-sanitizer is a PHP SVG/XML sanitizer. Prior to 1.0.0, Resolver::processReferences in src/ElementReference/Resolver.php builds the SVG reference graph with a case-sensitive href attribute predicate before cleanHrefAttributes normalizes mixed-case names. An attacker can provide xlink:HrEf on...

CVE-2026-107381

svg-sanitizer is a PHP SVG/XML sanitizer. Prior to 1.0.0, Resolver::processReferences in src/ElementReference/Resolver.php builds the SVG reference graph with a case-sensitive href attribute predicate before cleanHrefAttributes normalizes mixed-case names. An attacker can provide xlink:HrEf on...

EUVD-2026-101125

svg-sanitizer is a PHP SVG/XML sanitizer. Prior to 1.0.0, Resolver::processReferences in src/ElementReference/Resolver.php builds the SVG reference graph with a case-sensitive href attribute predicate before cleanHrefAttributes normalizes mixed-case names. An attacker can provide xlink:HrEf on...

CVE-2026-107381: Improper Handling of Case Sensitivity

svg-sanitizer is a PHP SVG/XML sanitizer. Prior to 1.0.0, Resolver::processReferences in src/ElementReference/Resolver.php builds the SVG reference graph with a case-sensitive href attribute predicate before cleanHrefAttributes normalizes mixed-case names. An attacker can provide xlink:HrEf on...

Denial Of Service (DoS)

svg-sanitizer is vulnerable to Denial Of Service DoS. The vulnerability is due to case-sensitive href attribute validation in Resolver::processReferences before mixed-case attributes are normalized, which allows an attacker to bypass the useNestingLimit protection with crafted nested SVG elements...

svg-sanitizer: Mixed-case xlink:HrEf skips the `<use>` nesting-DoS check in Resolver::processReferences

Summary Resolver::processReferences collects elements with the XPath predicate use@href or @xlink:href, which is case sensitive. A element written as xlink:HrEf is therefore never added to the reference graph, so the nesting-DoS nullification never marks it for removal...

GHSA-M9XH-6747-9R6F svg-sanitizer: Mixed-case xlink:HrEf skips the `<use>` nesting-DoS check in Resolver::processReferences

Summary Resolver::processReferences collects elements with the XPath predicate use@href or @xlink:href, which is case sensitive. A element written as xlink:HrEf is therefore never added to the reference graph, so the nesting-DoS nullification never marks it for removal...

PT-2026-108706

Name of the Vulnerable Software and Affected Versions svg-sanitizer versions prior to 1.0.0 Description An issue exists where the Resolver::processReferences function in src/ElementReference/Resolver.php builds the SVG reference graph using a case-sensitive predicate for the href attribute. Becau...