CVE-2026-104861

probe-image-size gets image dimensions without downloading the entire file. Prior to 7.4.0, lib/parsesync/svg.js and lib/parsestream/svg.js use the searching regular expression //, which repeatedly scans to the end of input when attacker-controlled data contains many less-than characters without ...

EUVD-2026-91768

probe-image-size gets image dimensions without downloading the entire file. Prior to 7.4.0, lib/parsesync/svg.js and lib/parsestream/svg.js use the searching regular expression //, which repeatedly scans to the end of input when attacker-controlled data contains many less-than characters without ...

CVE-2026-104861 probe-image-size: Quadratic-time Denial of Service in the SVG Parser

probe-image-size gets image dimensions without downloading the entire file. Prior to 7.4.0, lib/parsesync/svg.js and lib/parsestream/svg.js use the searching regular expression //, which repeatedly scans to the end of input when attacker-controlled data contains many less-than characters without ...

CVE-2026-104861

The probe-image-size library (versions <= 7.3.0) is vulnerable to a quadratic-time Denial of Service (DoS) attack due to inefficient regular expression handling in its SVG parser. Specifically, the regex /]*>/ causes the engine to repeatedly scan to the end of the input whenever it encounte...

The vulnerability of the parse_stream() function in the Expat.xs component of the libxml-parser-perl library allows a attacker to cause a denial-of-service attack.

The vulnerability of the parsestream function in the Expat.xs component of the libxml-parser-perl library is related to the escape character being output outside of the buffer. Exploiting this vulnerability could allow an attacker to cause a service failure...

CVE-2006-10002: Heap-based Buffer Overflow

XML::Parser versions through 2.45 for Perl could overflow the pre-allocated buffer size cause a heap corruption double free or corruption and crashes. A :utf8 PerlIO layer, parsestream in Expat.xs could overflow the XML input buffer because Perl's read returns decoded characters while SvPV gives...