# CVE-2021-21236: Regular Expression Denial of Service in CairoSVG

Source: https://junglewise.ai/threats/cve-2021-21236-regular-expression-denial-of-service-in-cairosvg  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2021-01-06  
License: CC BY 4.0 with a link back

CVE-2021-21236 · Severity: low · CVSS 3.1 · Published 2021-01-06

CairoSVG is a Python (pypi) package. CairoSVG is an SVG converter based on Cairo. In CairoSVG before version 2.5.1, there is a regular expression denial of service (REDoS) vulnerability. When processing SVG files, the python package CairoSVG uses two regular expressions which are vulnerable to Regular Expression Denial of Service (REDoS). If an attacker provides a malicious SVG, it can make cairosvg get stuck processing the file for a very long time. This is fixed in version 2.5.1. See Referenced GitHub advisory for more information.

Technologies: [CairoSVG (PyPI)](https://junglewise.ai/threats/technologies/cairosvg). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2021-21236 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2021-21236 being exploited in the wild.

**How severe is CVE-2021-21236?** Low severity, with a CVSS score of 3.1, published 6 January 2021.

**Which products and versions are affected?** CairoSVG (PyPI) ECOSYSTEM:introduced=0,fixed=2.5.1, GIT:introduced=0,fixed=cfc9175e590531d90384aa88845052de53d94bf3|ECOSYSTEM:introduced=0,fixed=2.5.1.

**Is there a fix for CVE-2021-21236?** Yes. CairoSVG (PyPI): upgrade to 2.5.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**Am I affected by CVE-2021-21236?** Check whether you run CairoSVG (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- CairoSVG (PyPI): upgrade to 2.5.1 or later

  ```sh
  pip install "CairoSVG>=2.5.1"
  ```


## Affected products

- CairoSVG (PyPI) ECOSYSTEM:introduced=0,fixed=2.5.1, GIT:introduced=0,fixed=cfc9175e590531d90384aa88845052de53d94bf3|ECOSYSTEM:introduced=0,fixed=2.5.1

## Identifiers

- CVE-2021-21236
- GHSA-hq37-853p-g5cf
- PYSEC-2021-5

## Related threats

- [CairoSVG quadratic-time DoS parsing crafted SVG path](https://junglewise.ai/threats/cve-2026-107378-cairosvg-quadratic-time-dos-parsing-a-crafted-svg-path)
- [Kozea CairoSVG exponential denial of service in defs.py](https://junglewise.ai/threats/cve-2026-31899-kozea-cairosvg-exponential-denial-of-service-in-defs-py)
- [CairoSVG improperly processes SVG files loaded from external resources](https://junglewise.ai/threats/cve-2023-27586-cairosvg-improperly-processes-svg-files-loaded-from-external)