CVE-2023-50251CWE-674

php-svg-lib possible DoS caused by infinite recursion when parsing SVG document

Medium · published December 12, 2023

CVSS v3.1
5.3
EPSS
1%
Percentile
58.6
In the wild
Unconfirmed
What it is

php-svg-lib is an SVG file parsing / rendering library. Prior to version 0.5.1, when parsing the attributes passed to a `use` tag inside an svg document, an attacker can cause the system to go to an infinite recursion. Depending on the system configuration and attack pattern this could exhaust the memory available to the executing process and/or to the server itself. An attacker sending multiple request to a system to render the above payload can potentially cause resource exhaustion to the point that the system is unable to handle incoming request. Version 0.5.1 contains a patch for this issue.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CVSS v4.0
Not supplied
EPSS
0.00878 · 58.6th percentile
Weakness
CWE-674 · Uncontrolled Recursion
Published
2023-12-12T20:37Z
EPSS history
Timeline
  • 12 DEC 20:37Z
    php-svg-lib possible DoS caused by infinite recursion when parsing SVG document
    cvelistv5