CVE-2026-121445 svg-sanitizer 1.0.0 before 1.1.0 ReDoS and Fail-Open via image-set CSS Stripping

darylldoyle svg-sanitizer from 1.0.0 before 1.1.0 contains a regular expression denial of service vulnerability in the image-set pattern of stripRemoteCssTokens when removeRemoteReferences is enabled. Attackers can submit SVGs with many unclosed image-set tokens to exhaust CPU, or trigger PCRE...

CVE-2026-121445

The svg-sanitizer library (versions 1.0.0 before 1.1.0 ) is vulnerable to a Regular Expression Denial of Service (ReDoS) and a fail-open condition. The flaw exists in the image-set pattern within the stripRemoteCssTokens() function when removeRemoteReferences is enabled. An attacker can provide S...

EUVD-2026-115867

darylldoyle svg-sanitizer from 1.0.0 before 1.1.0 contains a regular expression denial of service vulnerability in the image-set pattern of stripRemoteCssTokens when removeRemoteReferences is enabled. Attackers can submit SVGs with many unclosed image-set tokens to exhaust CPU, or trigger PCRE...

CVE-2026-121445: darylldoyle svg-sanitizer: darylldoyle svg-sanitizer from 1.0.0 before 1.1.0 contains a regular expression denial of service vulnerability in the…

darylldoyle svg-sanitizer from 1.0.0 before 1.1.0 contains a regular expression denial of service vulnerability in the image-set pattern of stripRemoteCssTokens when removeRemoteReferences is enabled. Attackers can submit SVGs with many unclosed image-set tokens to exhaust CPU, or trigger PCRE...

SUSE CVE-2022-0137

A heap buffer overflow in imagesetmask function of HTMLDOC before 1.9.15 allows an attacker to write outside the buffer boundaries...

PT-2022-6511

Name of the Vulnerable Software and Affected Versions Libde265 version 1.0.9 Description The issue is related to a heap buffer overflow in the de265 image::set SliceAddrRSint, int, int function of the Libde265 video codec. This can potentially allow an attacker to impact the confidentiality,...

UBUNTU-CVE-2022-0137

A heap buffer overflow in imagesetmask function of HTMLDOC before 1.9.15 allows an attacker to write outside the buffer boundaries...

PT-2022-12988 · Htmldoc +4 · Htmldoc +4

Name of the Vulnerable Software and Affected Versions: HTMLDOC versions prior to 1.9.15 Description: A heap buffer overflow issue exists in the image set mask function, allowing an attacker to write outside the buffer boundaries. Recommendations: For versions prior to 1.9.15, update to version...

PT-2019-12329

Name of the Vulnerable Software and Affected Versions libheif version 1.4.0 Description The issue is related to a use-after-free error in the heif::HeifContext::Image::set alpha channel function, located in heif context.h, due to mishandling of references to non-existing alpha images in heif...