Courtbouillon Cairosvg vulnerabilities

🔔 Create alert RSS Version checker

Published CVEs affecting Courtbouillon Cairosvg: 1 record(s), with affected versions and fixes.
cpe:2.3:a:courtbouillon:cairosvg

CVE-2026-31899 High · 7.5 CWE-674 Mar 13, 2026

CairoSVG vulnerable to Exponential DoS via recursive <use> element amplification

CairoSVG is an SVG converter based on Cairo, a 2D graphics library. Prior to Kozea/CairoSVG has exponential denial of service via recursive <use> element amplification in cairosvg/defs.py. This causes CPU exhaustion from a small input.