33 matches found
CairoSVG: Quadratic-time DoS parsing a crafted SVG <path>
SummaryRendering an untrusted SVG whose contains many segments is On² CPU. A single under 1 MiB burns tens of seconds. Two independent On² sites in cairosvg/path.py:1. Tokenizer — the path-data parser consumes the d string with a while string: loop that repeatedly slices/re-scans the remaining...
PYSEC-2026-4204 CairoSVG: Quadratic-time DoS parsing a crafted SVG <path>
Summary Rendering an untrusted SVG whose contains many segments is On² CPU. A single under 1 MiB burns tens of seconds. Two independent On² sites in cairosvg/path.py: 1. Tokenizer — the path-data parser consumes the d string with a while string: loop that repeatedly slices/re-scans the remaining...
Linux Distros Unpatched Vulnerability : CVE-2026-107378
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - CairoSVG is an SVG converter based on Cairo, a 2D graphics library. Prior to 2.9.1, rendering an attacker- controlled SVG with a path containing many segments c...
SUSE CVE-2026-107378
CairoSVG is an SVG converter based on Cairo, a 2D graphics library. Prior to 2.9.1, rendering an attacker-controlled SVG with a path containing many segments can cause quadratic CPU consumption in cairosvg/path.py. The path tokenizer repeatedly slices and rescans the remaining path data, while...
GHSA-C3JG-QH8M-J3H2 CairoSVG: Quadratic-time DoS parsing a crafted SVG <path>
Summary Rendering an untrusted SVG whose contains many segments is On² CPU. A single under 1 MiB burns tens of seconds. Two independent On² sites in cairosvg/path.py: 1. Tokenizer — the path-data parser consumes the d string with a while string: loop that repeatedly slices/re-scans the remaining...
CairoSVG: Quadratic-time DoS parsing a crafted SVG <path>
Summary Rendering an untrusted SVG whose contains many segments is On² CPU. A single under 1 MiB burns tens of seconds. Two independent On² sites in cairosvg/path.py: 1. Tokenizer — the path-data parser consumes the d string with a while string: loop that repeatedly slices/re-scans the remaining...
DEBIAN-CVE-2026-107378
CairoSVG is an SVG converter based on Cairo, a 2D graphics library. Prior to 2.9.1, rendering an attacker-controlled SVG with a path containing many segments can cause quadratic CPU consumption in cairosvg/path.py. The path tokenizer repeatedly slices and rescans the remaining path data, while...
CVE-2026-107378
CairoSVG is an SVG converter based on Cairo, a 2D graphics library. Prior to 2.9.1, rendering an attacker-controlled SVG with a path containing many segments can cause quadratic CPU consumption in cairosvg/path.py. The path tokenizer repeatedly slices and rescans the remaining path data, while...
UBUNTU-CVE-2026-107378
CairoSVG is an SVG converter based on Cairo, a 2D graphics library. Prior to 2.9.1, rendering an attacker-controlled SVG with a path containing many segments can cause quadratic CPU consumption in cairosvg/path.py. The path tokenizer repeatedly slices and rescans the remaining path data, while...
CVE-2026-107378 CairoSVG: Quadratic-time DoS parsing a crafted SVG <path>
CairoSVG is an SVG converter based on Cairo, a 2D graphics library. Prior to 2.9.1, rendering an attacker-controlled SVG with a path containing many segments can cause quadratic CPU consumption in cairosvg/path.py. The path tokenizer repeatedly slices and rescans the remaining path data, while...
CVE-2026-107378 CairoSVG: Quadratic-time DoS parsing a crafted SVG <path>
CairoSVG is an SVG converter based on Cairo, a 2D graphics library. Prior to 2.9.1, rendering an attacker-controlled SVG with a path containing many segments can cause quadratic CPU consumption in cairosvg/path.py. The path tokenizer repeatedly slices and rescans the remaining path data, while...
CVE-2026-107378
CairoSVG is an SVG converter based on Cairo, a 2D graphics library. Prior to 2.9.1, rendering an attacker-controlled SVG with a path containing many segments can cause quadratic CPU consumption in cairosvg/path.py. The path tokenizer repeatedly slices and rescans the remaining path data, while...
EUVD-2026-95135
CairoSVG is an SVG converter based on Cairo, a 2D graphics library. Prior to 2.9.1, rendering an attacker-controlled SVG with a path containing many segments can cause quadratic CPU consumption in cairosvg/path.py. The path tokenizer repeatedly slices and rescans the remaining path data, while...
CVE-2026-107378
The CairoSVG library, an SVG converter based on Cairo, is vulnerable to a Denial of Service (DoS) attack in versions prior to 2.9.1 . The root cause is an inefficient algorithmic complexity (CWE-407) within cairosvg/path.py, where the path tokenizer repeatedly slices and rescans path data. Additi...
CVE-2026-107378
CairoSVG is an SVG converter based on Cairo, a 2D graphics library. Prior to 2.9.1, rendering an attacker-controlled SVG with a path containing many segments can cause quadratic CPU consumption in cairosvg/path.py. The path tokenizer repeatedly slices and rescans the remaining path data, while...
CVE-2026-107378: Inefficient Algorithmic Complexity
CairoSVG is an SVG converter based on Cairo, a 2D graphics library. Prior to 2.9.1, rendering an attacker-controlled SVG with a path containing many segments can cause quadratic CPU consumption in cairosvg/path.py. The path tokenizer repeatedly slices and rescans the remaining path data, while...
PT-2026-108125
Name of the Vulnerable Software and Affected Versions CairoSVG versions prior to 2.9.1 Description Rendering an attacker-controlled SVG containing a path with many segments can lead to quadratic CPU consumption. This occurs due to two issues in cairosvg/path.py: the path tokenizer repeatedly slic...
PT-2026-108645
Summary Rendering an untrusted SVG whose contains many segments is On² CPU. A single under 1 MiB burns tens of seconds. Two independent On² sites in cairosvg/path.py: 1. Tokenizer — the path-data parser consumes the d string with a while string: loop that repeatedly slices/re-scans the remaining...
