Skip to content
fr Sign in
7.5 High

CVE-2026-31899 CairoSVG is an SVG converter based on Cairo, a 2D graphics library

Description

CairoSVG is an SVG converter based on Cairo, a 2D graphics library. Prior to Kozea/CairoSVG has exponential denial of service via recursive <use> element amplification in cairosvg/defs.py. This causes CPU exhaustion from a small input.

Affected products and versions

Product Affected versions Fixed in
CairoSVG 2.9 earliest → < 2.9.0 2.9.0

References

Timeline

  1. Published
  2. Last modified

Other CVEs of CairoSVG

The 4 CVEs of CairoSVG →
CVE-2026-107378 CairoSVG is an SVG converter based on Cairo, a 2D graphics library 8.7 High CVE-2023-27586 CairoSVG is an SVG converter based on Cairo, a 2D graphics library 9.9 Critical CVE-2021-21236 CairoSVG is a Python (pypi) package 5.7 Medium
Track this CVE