Junglewise Threat Intelligence

CVE-2026-31899: Kozea CairoSVG exponential denial of service in defs.py

CVE-2026-31899 · Severity: high · CVSS 7.5 · Published 2026-03-13

Technologies: CairoSVG (PyPI). Vendors: Kozea, PyPI.

Executive brief

CairoSVG is a popular library used to convert SVG files into other formats like PNG or PDF. A vulnerability allows an attacker to provide a specially crafted, small SVG file that causes the system to consume 100% of its CPU resources indefinitely. This can lead to a complete service outage for any application that processes user-provided images, such as profile picture uploaders or document generators.

Technical details

The vulnerability exists in the `use()` function within `cairosvg/defs.py`. The component fails to implement recursion depth limits or element budget constraints when processing SVG `<use>` elements. An attacker can craft a nested SVG structure where each level references the previous one multiple times, leading to O(10^N) rendering calls from a small input (e.g., a 1.4KB file). This results in indefinite CPU exhaustion without triggering Out-of-Memory (OOM) killers, as memory usage remains relatively flat. The issue is fixed in version 2.9.0.

Affected products

  • Kozea CairoSVG <= 2.8.2

Timeline

  • 2026-03-13: disclosed
  • 2026-03-13: advisory
  • 2026-03-13: patched: Fixed in version 2.9.0

References

Related threats