CVE-2023-50251

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

php-svg-lib is an SVG file parsing / rendering library. Prior to version 0.5.1, when parsing the attributes passed to a `use` tag inside an svg document, an attacker can cause the system to go to an infinite recursion. Depending on the system configuration and attack pattern this could exhaust the memory available to the executing process and/or to the server itself. An attacker sending multiple request to a system to render the above payload can potentially cause resource exhaustion to the point that the system is unable to handle incoming request. Version 0.5.1 contains a patch for this issue.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

Affected software

No affected versions have been published.

Timeline

Published
Dec 12, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-502529.8php-svg-lib is an SVG file parsing / rendering library. Prior to version 0.5.1, when handling `<use>` tag that references an `<image>` tag, CVE-2023-502536.5Laf is a cloud development platform. In the Laf version design, the log uses communication with k8s to quickly retrieve logs from the contaiCVE-2023-502547.8Deepin Linux's default document reader `deepin-reader` software suffers from a serious vulnerability in versions prior to 6.0.7 due to a desCVE-2023-502557.8Deepin-Compressor is the default archive manager of Deepin Linux OS. Prior to 5.12.21, there's a path traversal vulnerability in deepin-compCVE-2023-502567.5Froxlor is open source server administration software. Prior to version 2.1.2, it was possible to submit the registration form with the esseCVE-2023-502578.1eProsima Fast DDS (formerly Fast RTPS) is a C++ implementation of the Data Distribution Service standard of the Object Management Group. EveCVE-2023-502585.3Medusa is an automatic video library manager for TV shows. Versions prior to 1.0.19 are vulnerable to unauthenticated blind server-side requCVE-2023-502595.3Medusa is an automatic video library manager for TV shows. Versions prior to 1.0.19 are vulnerable to unauthenticated blind server-side requCVE-2023-50266.1A vulnerability classified as problematic has been found in Tongda OA 11.10. Affected is an unknown function of the file /general/ipanel/menCVE-2023-502608.8Wazuh is a free and open source platform used for threat prevention, detection, and response. A wrong validation in the `host_deny` script aCVE-2023-502627.5Dompdf is an HTML to PDF converter for PHP. When parsing SVG images Dompdf performs an initial validation to ensure that paths within the SVCVE-2023-502635.3Nautobot is a Network Source of Truth and Network Automation Platform built as a web application atop the Django Python framework with a Pos
CVE-2023-50251: High severity, CVSS 7.5 | Vulnix