The PHP SVG/XML sanitizer builds a graph of nested <use> elements by matching a case‑sensitive href predicate before the library normalizes mixed‑case names. An attacker can inject xlink:HrEf on nested <use> tags, causing the graph builder to skip those references. The sanitizer then converts the attribute to the canonical form and returns an expanded nesting structure without applying the useNestingLimit protection, allowing an attacker to subvert the resource limits intended to prevent denial of service.

The vulnerability affects the svg‑sanitizer library by darylldoyle. Any installation of a version earlier than 1.0.0 is vulnerable; the official fix is included in version 1.0.0 and later.

The CVSS score of 6.5 indicates medium severity, and the EPSS score is below 1%. The issue is not listed in the CISA KEV catalog. An attacker must supply a crafted SVG document containing nested <use> elements with a mixed‑case xlink:HrEf attribute; the sanitizer will convert the attribute, build a nesting graph, and return a live structure that can exhaust server or client resources. The primary target is the consuming application that renders the sanitized SVG.