CVE-2026-31899
CairoSVG is an SVG converter based on Cairo, a 2D graphics library.
Published Mar 13, 2026 · updated Jun 17, 2026 · courtbouillon cairosvg
CairoSVG is an SVG converter based on Cairo, a 2D graphics library. Prior to Kozea/CairoSVG has exponential denial of service via recursive element amplification in cairosvg/defs.py. This causes CPU exhaustion from a small input.
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
Mar 13, 2026 · NIST NVD
Detected
CairoSVG is an SVG converter based on Cairo, a 2D graphics library. Prior to Kozea/CairoSVG has exponential denial of service via recursive element amplification in cairosvg/defs.py. This causes CPU exhaustion from a small input.
Jun 17, 2026 · NIST NVD
Updated
CairoSVG is an SVG converter based on Cairo, a 2D graphics library. Prior to Kozea/CairoSVG has exponential denial of service via recursive element amplification in cairosvg/defs.py. This causes CPU exhaustion from a small input.
Affected
- cpe courtbouillon/cairosvgversion unspecified
Sources
- CVE.orgVulnerability recordCVE-2026-31899
Official CVE identifier
cve.org - NIST NVDVulnerability recordCVE-2026-31899
CairoSVG is an SVG converter based on Cairo, a 2D graphics library. Prior to Kozea/CairoSVG has exponential denial of service via recursive element amplification in cairosvg/defs.py. This causes CPU exhaustion from a small input.
nvd.nist.gov