TI-2023-27479 Aliases CVE-2023-50251 GHSA-ff5x-7qg5-vwf2

php-svg-lib possible DoS caused by infinite recursion when parsing SVG document

HIGH 72CWE-674Published 2023-12-12 · Updated 2025-05-22

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Denial of service
Confidentiality · integrity · availability: None · None · High
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-674.

Summary

php-svg-lib is an SVG file parsing / rendering library. Prior to version 0.5.1, when parsing the attributes passed to a `use` tag inside an svg document, an attacker can cause the system to go to an infinite recursion. Depending on the system configuration and attack pattern this could exhaust the memory available to the executing process and/or to the server itself. An attacker sending multiple request to a system to render the above payload can potentially cause resource exhaustion to the point that the system is unable to handle incoming request. Version 0.5.1 contains a patch for this issue.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00878 59th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed php-svg-lib (dompdf): 0.5.1phenx/php-svg-lib (Packagist): 0.5.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
dompdf	php-svg-lib	before 0.5.1	0.5.1	Patch available	CNA
—	phenx/php-svg-lib (Packagist)	before 0.5.1	0.5.1	Patch available	GHSA-ff5x-7qg5-vwf2

php-svg-lib Vendordompdf Affected before 0.5.1 Fixed in 0.5.1 Patch available CNA
phenx/php-svg-lib (Packagist) Vendor— Affected before 0.5.1 Fixed in 0.5.1 Patch available GHSA-ff5x-7qg5-vwf2

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:dompdf:php-svg-lib::::::::	before 0.5.1	Vulnerable	dompdf

cpe:2.3:a:dompdf:php-svg-lib:*:*:*:*:*:*:*:* Versions before 0.5.1 Vulnerable ·dompdf

Remediation

Fix · CNA php-svg-lib (dompdf) Fixed in 0.5.1
Fix · GHSA-ff5x-7qg5-vwf2 phenx/php-svg-lib (Packagist) Fixed in 0.5.1 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2023-50251
2026-10-03 Alias added: GHSA-ff5x-7qg5-vwf2

References

TI-2024-16571 php-svg-lib lacks path validation on font through SVG inline styles CVSS 3.1CRITICAL 9.8
TI-2023-27480 php-svg-lib unsafe attributes merge when parsing `use` tag CVSS 3.1CRITICAL 9.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences