Fluid Attacks Database

Description

CairoSVG is an SVG converter based on Cairo, a 2D graphics library. Prior to Kozea/CairoSVG has exponential denial of service via recursive element amplification in cairosvg/defs.py. This causes CPU exhaustion from a small input.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Package	Affected version	Patched versions
debian 11	cairosvg	=2.5.0-1.1 \|\| =2.5.0-1.1+deb11u1 \|\| =2.5.0-1.1+deb11u2 \|\| =2.5.2-1 \|\| =2.5.2-1.1 \|\| =2.7.0-1 \|\| =2.7.1-1 \|\| =2.7.1-2 \|\| =2.8.2-1 \|\| =2.9.0-1	-
pypi	cairosvg	>=0 <2.9.0	2.9.0
debian 12	cairosvg	=2.5.2-1.1 \|\| =2.5.2-1.1+deb12u1 \|\| =2.7.0-1 \|\| =2.7.1-1 \|\| =2.7.1-2 \|\| =2.8.2-1 \|\| =2.9.0-1	-
debian 13	cairosvg	=2.7.1-2 \|\| =2.8.2-1 \|\| =2.9.0-1	-
debian 14	cairosvg	=2.7.1-2 \|\| =2.8.2-1 \|\| =2.9.0-1	-

Aliases

1. CVE-2026-318992. NVD-2026-318993. OSV-DEBIAN-2026-318994. OSV-2026-318995. GHSA-f38f-5xpm-9r7c6. GCVE-2026-318997. SECURITY-TRACKER-CVE-2026-31899

References

1. https://github.com/SnailSploit/CVE-2026-318992. https://github.com/Kozea/CairoSVG/security/advisories/GHSA-f38f-5xpm-9r7c3. https://github.com/Kozea/CairoSVG/commit/6dde8685ed3f19837767bce7a13a5491e3d0e0bf