CVE-2026-31899

CVE-2026-31899: Exponential DoS via Recursive Element Amplification in CairoSVG Keywords: CVE-2026-31899, CairoSVG, exponential DoS, SVG bomb, recursive use element, denial of service, XML amplification, Python SVG vulnerability, CWE-400, uncontrolled resource consumption, billion laughs SVG Tabl...

python313-CairoSVG-2.9.1-1.1 on GA media (moderate)

python313-CairoSVG-2.9.1-1.1 on GA media Announcement ID: openSUSE-SU-2026:12111-1 Rating: moderate Cross-References: CVE-2026-107378 CVSS scores: CVE-2026-107378 SUSE : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2026-107378 SUSE : 8.7...

Fedora 43 : python-cairosvg (2026-0a3e8cc0a0)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-0a3e8cc0a0 advisory. Update to 2.9.1 upstream release CVE-2026-107378 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that...

ROOT-APP-PYPI-CVE-2026-31899 CVE-2026-31899 in cairosvg - Patched by Root

Root has patched CVE-2026-31899 in the cairosvg package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2026-107378 CVE-2026-107378 in cairosvg - Patched by Root

Root has patched CVE-2026-107378 in the cairosvg package for Root:PyPI. Multiple fixed versions available...

[SECURITY] Fedora 44 Update: python-cairosvg-2.9.1-1.fc44

CairoSVG is a SVG 1.1 to PNG, PDF, PS and SVG converter which can also be used as a Python library...

Fedora 44 : python-cairosvg (2026-72e46336ad)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-72e46336ad advisory. Update to 2.9.1 upstream release CVE-2026-107378 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that...

wiking (>=2.2.1, <=2.3.3) potentially affected by CVE-2026-107378 via cairosvg (0.5.0)

cairosvg PYPI version 0.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on cairosvg and may be impacted: - wiking =2.2.1, =2.3.3 Source cves: CVE-2026-107378 Source advisory: OSV:PYSEC-2026-4204...

CairoSVG: Quadratic-time DoS parsing a crafted SVG <path>

SummaryRendering an untrusted SVG whose contains many segments is On² CPU. A single under 1 MiB burns tens of seconds. Two independent On² sites in cairosvg/path.py:1. Tokenizer — the path-data parser consumes the d string with a while string: loop that repeatedly slices/re-scans the remaining...

aksharify (0.2.0), chem-eclipse (0.1.0) +56 more potentially affected by CVE-2026-107378 via cairosvg (>=2.1.3, <=2.9.0)

cairosvg PYPI version =2.1.3, =0.1.0, =0.20.7, =1.0.0b1, =1.5.3, =1.5.3, =1.5.3, =0.0.2, =2025.5.0b2, =1.0.0, =2.1.0 and more Source cves: CVE-2026-107378 Source advisory: OSV:PYSEC-2026-4204...

PYSEC-2026-4204 CairoSVG: Quadratic-time DoS parsing a crafted SVG <path>

Summary Rendering an untrusted SVG whose contains many segments is On² CPU. A single under 1 MiB burns tens of seconds. Two independent On² sites in cairosvg/path.py: 1. Tokenizer — the path-data parser consumes the d string with a while string: loop that repeatedly slices/re-scans the remaining...

buildbot-badges (>=1.7.0, <=1.8.2), no-cloud (0.0.8) potentially affected by CVE-2026-107378 via cairosvg (1.0.22)

cairosvg PYPI version 1.0.22 is affected by a known vulnerability. The following packages have a transitive dependency on cairosvg and may be impacted: - buildbot-badges =1.7.0, =1.8.2 - no-cloud 0.0.8 Source cves: CVE-2026-107378 Source advisory: OSV:PYSEC-2026-4204...

Linux Distros Unpatched Vulnerability : CVE-2026-107378

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - CairoSVG is an SVG converter based on Cairo, a 2D graphics library. Prior to 2.9.1, rendering an attacker- controlled SVG with a path containing many segments c...

Fedora 46 : python-cairosvg (2026-03d5084cef)

The remote Fedora 46 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-03d5084cef advisory. Automatic update for python-cairosvg-2.9.1-1.fc46. Changelog Tue Oct 13 2026 Packit - 2.9.1-1 - Update to 2.9.1 upstream release - Resolves: rhbz2529345 -...

CVE-2026-107378

A flaw was found in CairoSVG. A remote attacker can cause a Denial of Service DoS by providing a specially crafted Scalable Vector Graphics SVG file containing paths with numerous segments. Inefficient path processing leads to excessive CPU resource consumption during rendering, causing the...

OPENSUSE-SU-2026:12111-1 python313-CairoSVG-2.9.1-1.1 on GA media

These are all security issues fixed in the python313-CairoSVG-2.9.1-1.1 package on the GA media of openSUSE Tumbleweed...

python313-CairoSVG-2.9.0-1.3 on GA media (moderate)

python313-CairoSVG-2.9.0-1.3 on GA media Announcement ID: openSUSE-SU-2026:11989-1 Rating: moderate Cross-References: CVE-2021-21236 CVE-2023-27586 Affected Products: openSUSE Tumbleweed An update that solves 2 vulnerabilities can now be installed. Description: These are all security issues fixed...

SUSE CVE-2026-107378

CairoSVG is an SVG converter based on Cairo, a 2D graphics library. Prior to 2.9.1, rendering an attacker-controlled SVG with a path containing many segments can cause quadratic CPU consumption in cairosvg/path.py. The path tokenizer repeatedly slices and rescans the remaining path data, while...

wiking (>=2.2.1, <=2.3.3) potentially affected by CVE-2026-107378 via cairosvg (0.5.0)

cairosvg PYPI version 0.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on cairosvg and may be impacted: - wiking =2.2.1, =2.3.3 Source cves: CVE-2026-107378 Source advisory: OSV:GHSA-C3JG-QH8M-J3H2...

buildbot-badges (>=1.7.0, <=1.8.2), no-cloud (0.0.8) potentially affected by CVE-2026-107378 via cairosvg (1.0.22)

cairosvg PYPI version 1.0.22 is affected by a known vulnerability. The following packages have a transitive dependency on cairosvg and may be impacted: - buildbot-badges =1.7.0, =1.8.2 - no-cloud 0.0.8 Source cves: CVE-2026-107378 Source advisory: OSV:GHSA-C3JG-QH8M-J3H2...