Executive brief
CairoSVG is a popular library used to convert SVG files into other formats like PNG or PDF. A vulnerability allows an attacker to provide a specially crafted, small SVG file that causes the system to consume 100% of its CPU resources indefinitely. This can lead to a complete service outage for any application that processes user-provided images, such as profile picture uploaders or document generators.
Technical details
The vulnerability exists in the `use()` function within `cairosvg/defs.py`. The component fails to implement recursion depth limits or element budget constraints when processing SVG `<use>` elements. An attacker can craft a nested SVG structure where each level references the previous one multiple times, leading to O(10^N) rendering calls from a small input (e.g., a 1.4KB file). This results in indefinite CPU exhaustion without triggering Out-of-Memory (OOM) killers, as memory usage remains relatively flat. The issue is fixed in version 2.9.0.
Affected products
- Kozea CairoSVG <= 2.8.2
Timeline
- 2026-03-13: disclosed
- 2026-03-13: advisory
- 2026-03-13: patched: Fixed in version 2.9.0