137 matches found
CairoSVG: Quadratic-time DoS parsing a crafted SVG <path>
Summary Rendering an untrusted SVG whose contains many segments is Onยฒ CPU. A single under 1 MiB burns tens of seconds. Two independent Onยฒ sites in cairosvg/path.py: 1. Tokenizer โ the path-data parser consumes the d string with a while string: loop that repeatedly slices/re-scans the remaining...
DEBIAN-CVE-2026-107378
CairoSVG is an SVG converter based on Cairo, a 2D graphics library. Prior to 2.9.1, rendering an attacker-controlled SVG with a path containing many segments can cause quadratic CPU consumption in cairosvg/path.py. The path tokenizer repeatedly slices and rescans the remaining path data, while...
CVE-2026-107378
CairoSVG is an SVG converter based on Cairo, a 2D graphics library. Prior to 2.9.1, rendering an attacker-controlled SVG with a path containing many segments can cause quadratic CPU consumption in cairosvg/path.py. The path tokenizer repeatedly slices and rescans the remaining path data, while...
EUVD-2026-95135
CairoSVG is an SVG converter based on Cairo, a 2D graphics library. Prior to 2.9.1, rendering an attacker-controlled SVG with a path containing many segments can cause quadratic CPU consumption in cairosvg/path.py. The path tokenizer repeatedly slices and rescans the remaining path data, while...
CVE-2026-107378
The CairoSVG library, an SVG converter based on Cairo, is vulnerable to a Denial of Service (DoS) attack in versions prior to 2.9.1 . The root cause is an inefficient algorithmic complexity (CWE-407) within cairosvg/path.py, where the path tokenizer repeatedly slices and rescans path data. Additi...
CVE-2026-107378 CairoSVG: Quadratic-time DoS parsing a crafted SVG <path>
CairoSVG is an SVG converter based on Cairo, a 2D graphics library. Prior to 2.9.1, rendering an attacker-controlled SVG with a path containing many segments can cause quadratic CPU consumption in cairosvg/path.py. The path tokenizer repeatedly slices and rescans the remaining path data, while...
CVE-2026-107378 CairoSVG: Quadratic-time DoS parsing a crafted SVG <path>
CairoSVG is an SVG converter based on Cairo, a 2D graphics library. Prior to 2.9.1, rendering an attacker-controlled SVG with a path containing many segments can cause quadratic CPU consumption in cairosvg/path.py. The path tokenizer repeatedly slices and rescans the remaining path data, while...
CVE-2026-31899
CVE-2026-31899: CairoSVG ใฎๅๅธฐ็ ่ฆ็ด ๅขๅน ใซใใๆๆฐ้ขๆฐ็ DoS ใญใผใฏใผใ: CVE-2026-31899ใCairoSVGใๆๆฐ้ขๆฐ็ DoSใSVG ็ๅผพใๅๅธฐ็ use ่ฆ็ด ใใตใผใในๅฆจๅฎณใXML ๅขๅน ใPython SVG ใฎ่ๅผฑๆงใCWE-400ใๅถๅพกไธ่ฝใชใชใฝใผในๆถ่ฒปใbillion laughs SVG ็ฎๆฌก ๆฆ่ฆ ่ๅผฑๆงใฎ่ฉณ็ดฐ ๆ่ก็ๅๆ ๆฆๅฟตๅฎ่จผ ๅฝฑ้ฟ ๅฏพ็ญ CVSS ใกใใชใฏใน ๅ็ ง ้ฃ็ตกๅ ๆฆ่ฆ CairoSVG ใซใใใๆๆฐ้ขๆฐ็ใตใผใในๅฆจๅฎณ๏ผDoS๏ผCVE-2026-31899 โ ใใใ 1,411 ใใคใใฎ SVG...
PT-2026-105698
These are all security issues fixed in the python313-CairoSVG-2.9.0-1.3 package on the GA media of openSUSE Tumbleweed...
OPENSUSE-SU-2026:11989-1 python313-CairoSVG-2.9.0-1.3 on GA media
These are all security issues fixed in the python313-CairoSVG-2.9.0-1.3 package on the GA media of openSUSE Tumbleweed...
ROOT-APP-PYPI-CVE-2026-31899 CVE-2026-31899 in cairosvg - Patched by Root
Root has patched CVE-2026-31899 in the cairosvg package for Root:PyPI. Multiple fixed versions available...
Astra Linux โ Vulnerability in cairosvg
CairoSVG is an SVG converter based on Cairo, a 2D graphics library. Prior to Kozea/CairoSVG, there was exponential denial of service due to recursive elements being amplified in the cairosvg/defs.py file. This caused CPU exhaustion with even small inputs...
Security update for python-CairoSVG (moderate)
openSUSE security update: security update for python-cairosvg ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:20886-1 Rating: moderate References: bsc1259690 Cross-References: CVE-2026-31899 CVSS scores: CVE-2026-31899 SUSE : 5.5...
SUSE-SU-2026:22024-1 Security update for python-CairoSVG
This update for python-CairoSVG fixes the following issue: - CVE-2026-31899: denial of service via recursive element amplification bsc1259690...
OPENSUSE-SU-2026:20886-1 Security update for python-CairoSVG
This update for python-CairoSVG fixes the following issue: - CVE-2026-31899: denial of service via recursive element amplification bsc1259690...
The vulnerability of the SVG converter CairoSVG, related to uncontrolled recursion, allows attackers to cause service failures.
The vulnerability of the SVG converter CairoSVG is related to uncontrolled recursion. Exploiting this vulnerability could allow a remote attacker to cause service failures...
๐ CairoSVG Denial of Service
CairoSVG versions prior to 2.9.0 suffer from a recursive denial of service vulnerability. CVE-2026-31899: Exponential DoS via Recursive Element Amplification in CairoSVG Keywords: CVE-2026-31899, CairoSVG, exponential DoS, SVG bomb, recursive use element, denial of service, XML amplification,...
ROS-20260506-73-0049
Vulnerability in python-cairosvg related to uncontrolled recursion. Exploitation of the vulnerability could allow an attacker to cause a denial of service...
[SECURITY] Fedora 44 Update: python-cairosvg-2.9.0-1.fc44
CairoSVG is a SVG 1.1 to PNG, PDF, PS and SVG converter which can also be used as a Python library...
Fedora 44 : python-cairosvg (2026-448e26a9c8)
The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-448e26a9c8 advisory. Security fix for CVE-2026-31899: https://nvd.nist.gov/vuln/detail/CVE-2026-31899 / https://github.com/Kozea/CairoSVG/security/advisories/GHSA-f38f-5xpm-9r7c...