# CVE-2026-114610: fpdf2 SVG nested reference exponential DoS

Source: https://junglewise.ai/threats/cve-2026-114610-fpdf2-is-a-pdf-creation-library-for-python-from-2-5-0-until-2-8  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-22. Updated: 2026-10-22  
License: CC BY 4.0 with a link back

CVE-2026-114610 · Severity: medium · CVSS 6.5 · Published 2026-10-22

fpdf2 is a Python library for creating PDF documents. When processing SVG images with deeply nested <use> references, the library recursively copies entire graphics trees, causing exponential growth in memory and CPU consumption. An attacker can supply a specially crafted SVG file that triggers a denial of service, crashing PDF generation jobs and exhausting server resources.

Vendors: [Py-Pdf](https://junglewise.ai/threats/vendors/py-pdf), [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-114610 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-114610 being exploited in the wild.

**How severe is CVE-2026-114610?** Medium severity, with a CVSS score of 6.5, published 22 October 2026.

**Which products and versions are affected?** Py-Pdf Fpdf2 2.5.0 to 2.8.7; fpdf2 (PyPI) >= 2.5.0, < 2.8.8, ECOSYSTEM:introduced=2.5.0,fixed=2.8.8.

**Is there a fix for CVE-2026-114610?** Yes. fpdf2 (PyPI): upgrade to 2.8.8 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-114610 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-114610?** Check whether you run Py-Pdf Fpdf2 or fpdf2 (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- fpdf2 (PyPI): upgrade to 2.8.8 or later

  ```sh
  pip install "fpdf2>=2.8.8"
  ```


## Technical details

CVE-2026-114610 affects fpdf2 versions 2.5.0 through 2.8.7. The vulnerability exists in SVGObject.build_xref(), which passes nested SVG <use> references to GraphicsContext.add_item() with the default clone=True behavior, causing deep copies of referenced graphics at each nesting level. This results in exponential object count and processing growth. The attack requires only inline SVG references with no external resources, making ResourceAccessPolicy ineffective. A fix is provided in version 2.8.8 via SVG complexity limits.

## Affected products

- py-pdf fpdf2 2.5.0 to 2.8.7

## Identifiers

- CVE-2026-114610
- GHSA-wqw6-wpr3-45rh

## Timeline

- 2026-10-22: disclosed
- 2026-07-21: patched: Fix committed before CVE disclosure

## References

- [https://github.com/py-pdf/fpdf2/commit/d7bd1061205d50da6a541dadfdb9d66beb763f2f](https://github.com/py-pdf/fpdf2/commit/d7bd1061205d50da6a541dadfdb9d66beb763f2f)
- [https://github.com/py-pdf/fpdf2/pull/1889](https://github.com/py-pdf/fpdf2/pull/1889)

## Related threats

- [fpdf2 SSRF and local file disclosure in image loader](https://junglewise.ai/threats/cve-2026-114609-fpdf2-is-a-pdf-creation-library-for-python-prior-to-2-8-8-fpdf2)