Skip to content
CVE PROGRAM SOURCE RECORD7.5 High

CVE-2026-31899

CairoSVG vulnerable to Exponential DoS via recursive <use> element amplification

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
GitHub_M

Description

CairoSVG is an SVG converter based on Cairo, a 2D graphics library. Prior to Kozea/CairoSVG has exponential denial of service via recursive <use> element amplification in cairosvg/defs.py. This causes CPU exhaustion from a small input.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Kozea CairoSVG

  • < 2.9.0affected

References