Fpdf2: Exponential SVG '<use>' Expansion Causes CPU And Memory Exhaustion In 'FPDF.image()'

Summary fpdf2 expands SVG "" references by deep-copying the complete referenced graphics tree. A small SVG can use nested references to make the number of in-memory objects grow exponentially, causing excessive CPU and memory consumption during "FPDF.image" processing. This was reproduced with an...

Fpdf2 Implicitly Loads External URLs And Local Image Paths When Rendering Attacker-controlled Content

Summary "fpdf2" implicitly dereferences image resource references supplied to rendering APIs. If an application passes untrusted HTML, SVG, template data, or image paths into those APIs, "fpdf2" may issue outbound HTTPS requests or attempt to open local filesystem paths. This behavior is relevant...

anvyl (>=0.1.0, <=0.1.22), aurapro-ui (>=3.1.0, <=3.9.3) +65 more potentially affected by CVE-2026-114610 via fpdf2 (>=2.5.0, <=2.8.7)

fpdf2 PYPI version =2.5.0, =0.1.0, =3.1.0, =3.9.11, =0.7.0a0, =3.0.0, =1.0.0, =0.1.0, =0.1.23, =2026.2.23, =0.0.1, =1.0.0, =0.2.10, =0.1.2, =0.1.3.61 and more Source cves: CVE-2026-114610 Source advisory: OSV:GHSA-WQW6-WPR3-45RH...

GHSA-WQW6-WPR3-45RH fpdf2: Exponential SVG '<use>' expansion causes CPU and memory exhaustion in 'FPDF.image()'

Summary fpdf2 expands SVG references by deep-copying the complete referenced graphics tree. A small SVG can use nested references to make the number of in-memory objects grow exponentially, causing excessive CPU and memory consumption during FPDF.image processing. This was reproduced with an...

EUVD-2026-108262

fpdf2: Exponential SVG '' expansion causes CPU and memory exhaustion in 'FPDF.image'...

anvyl (>=0.1.0, <=0.1.22), aurapro-ui (>=3.1.0, <=3.9.3) +65 more potentially affected by CVE-2026-114610 via fpdf2 (>=2.5.0, <=2.8.7)

fpdf2 PYPI version =2.5.0, =0.1.0, =3.1.0, =3.9.11, =0.7.0a0, =3.0.0, =1.0.0, =0.1.0, =0.1.23, =2026.2.23, =0.0.1, =1.0.0, =0.2.10, =0.1.2, =0.1.3.61 and more Source cves: CVE-2026-114610 Source advisory: GHSA-WQW6-WPR3-45RH...

fpdf2: Exponential SVG '<use>' expansion causes CPU and memory exhaustion in 'FPDF.image()'

Summary fpdf2 expands SVG references by deep-copying the complete referenced graphics tree. A small SVG can use nested references to make the number of in-memory objects grow exponentially, causing excessive CPU and memory consumption during FPDF.image processing. This was reproduced with an...

fpdf2 implicitly loads external URLs and local image paths when rendering attacker-controlled content

Summary fpdf2 implicitly dereferences image resource references supplied to rendering APIs. If an application passes untrusted HTML, SVG, template data, or image paths into those APIs, fpdf2 may issue outbound HTTPS requests or attempt to open local filesystem paths. This behavior is relevant in...

anvyl (>=0.1.0, <=0.1.22), aurapro-ui (>=3.1.0, <=3.9.3) +67 more potentially affected by CVE-2026-114609 via fpdf2 (>=2.0.3, <=2.8.7)

fpdf2 PYPI version =2.0.3, =0.1.0, =3.1.0, =3.9.11, =0.7.0a0, =3.0.0, =1.0.0, =0.1.0, =0.1.23, =2026.2.23, =0.0.1, =1.0.0, =0.2.10, =0.1.2, =0.1.3.61 and more Source cves: CVE-2026-114609 Source advisory: GHSA-RW7V-4HRQ-X6R9...

EUVD-2026-108261

fpdf2 implicitly loads external URLs and local image paths when rendering attacker-controlled content...

anvyl (>=0.1.0, <=0.1.22), aurapro-ui (>=3.1.0, <=3.9.3) +67 more potentially affected by CVE-2026-114609 via fpdf2 (>=2.0.3, <=2.8.7)

fpdf2 PYPI version =2.0.3, =0.1.0, =3.1.0, =3.9.11, =0.7.0a0, =3.0.0, =1.0.0, =0.1.0, =0.1.23, =2026.2.23, =0.0.1, =1.0.0, =0.2.10, =0.1.2, =0.1.3.61 and more Source cves: CVE-2026-114609 Source advisory: OSV:GHSA-RW7V-4HRQ-X6R9...

GHSA-RW7V-4HRQ-X6R9 fpdf2 implicitly loads external URLs and local image paths when rendering attacker-controlled content

Summary fpdf2 implicitly dereferences image resource references supplied to rendering APIs. If an application passes untrusted HTML, SVG, template data, or image paths into those APIs, fpdf2 may issue outbound HTTPS requests or attempt to open local filesystem paths. This behavior is relevant in...

PT-2026-127773

These are all security issues fixed in the python313-fpdf2-2.8.9-2.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2026:12278-1 python313-fpdf2-2.8.9-2.1 on GA media

These are all security issues fixed in the python313-fpdf2-2.8.9-2.1 package on the GA media of openSUSE Tumbleweed...

SUSE CVE-2026-114609

fpdf2 is a PDF creation library for Python. Prior to 2.8.8, fpdf2's shared image loader automatically dereferences attacker-controlled HTTPS URLs and raw local paths supplied through FPDF.image, FPDF.writehtml HTML values, SVG or xlink:href values, and template image fields. This can cause outbou...

SUSE CVE-2026-114610

fpdf2 is a PDF creation library for Python. From 2.5.0 until 2.8.8, fpdf2's SVGObject.buildxref passes nested SVG references to GraphicsContext.additem, whose default clone=True deep-copy behavior copies the complete referenced graphics tree during FPDF.image processing. Repeating references at...

Linux Distros Unpatched Vulnerability : CVE-2026-114610

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - fpdf2 is a PDF creation library for Python. From 2.5.0 until 2.8.8, fpdf2's SVGObject.buildxref passes nested SVG references to GraphicsContext.additem, whose...

Linux Distros Unpatched Vulnerability : CVE-2026-114609

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - fpdf2 is a PDF creation library for Python. Prior to 2.8.8, fpdf2's shared image loader automatically dereferences attacker-controlled HTTPS URLs and raw local...

CVE-2026-114610

fpdf2 is a PDF creation library for Python. From 2.5.0 until 2.8.8, fpdf2's SVGObject.buildxref passes nested SVG references to GraphicsContext.additem, whose default clone=True deep-copy behavior copies the complete referenced graphics tree during FPDF.image processing. Repeating references at...

DEBIAN-CVE-2026-114609

fpdf2 is a PDF creation library for Python. Prior to 2.8.8, fpdf2's shared image loader automatically dereferences attacker-controlled HTTPS URLs and raw local paths supplied through FPDF.image, FPDF.writehtml HTML values, SVG or xlink:href values, and template image fields. This can cause outbou...