# CVE-2026-31899: Kozea CairoSVG exponential denial of service in defs.py

Source: https://junglewise.ai/threats/cve-2026-31899-kozea-cairosvg-exponential-denial-of-service-in-defs-py  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-03-13. Updated: 2026-05-11  
License: CC BY 4.0 with a link back

CVE-2026-31899 · Severity: high · CVSS 7.5 · Published 2026-03-13

CairoSVG is a popular library used to convert SVG files into other formats like PNG or PDF. A vulnerability allows an attacker to provide a specially crafted, small SVG file that causes the system to consume 100% of its CPU resources indefinitely. This can lead to a complete service outage for any application that processes user-provided images, such as profile picture uploaders or document generators.

Technologies: [CairoSVG (PyPI)](https://junglewise.ai/threats/technologies/cairosvg). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-31899 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-31899 being exploited in the wild.

**How severe is CVE-2026-31899?** High severity, with a CVSS score of 7.5, published 13 March 2026.

**Which products and versions are affected?** CairoSVG (PyPI) <= 2.8.2, ECOSYSTEM:introduced=0,fixed=2.9.0.

**Is there a fix for CVE-2026-31899?** Yes. CairoSVG (PyPI): upgrade to 2.9.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-31899 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-31899?** Check whether you run CairoSVG (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- CairoSVG (PyPI): upgrade to 2.9.0 or later

  ```sh
  pip install "CairoSVG>=2.9.0"
  ```


## Technical details

The vulnerability exists in the `use()` function within `cairosvg/defs.py`. The component fails to implement recursion depth limits or element budget constraints when processing SVG `<use>` elements. An attacker can craft a nested SVG structure where each level references the previous one multiple times, leading to O(10^N) rendering calls from a small input (e.g., a 1.4KB file). This results in indefinite CPU exhaustion without triggering Out-of-Memory (OOM) killers, as memory usage remains relatively flat. The issue is fixed in version 2.9.0.

## Affected products

- Kozea CairoSVG <= 2.8.2

## Identifiers

- CVE-2026-31899
- GHSA-f38f-5xpm-9r7c
- PYSEC-2026-2122

## Timeline

- 2026-03-13: disclosed
- 2026-03-13: advisory
- 2026-03-13: patched: Fixed in version 2.9.0

## References

- [https://api.github.com/users/SnailSploit](https://api.github.com/users/SnailSploit)
- [https://github.com/SnailSploit](https://github.com/SnailSploit)
- [https://api.github.com/users/SnailSploit/gists%7B/gist_id%7D](https://api.github.com/users/SnailSploit/gists%7B/gist_id%7D)
- [https://api.github.com/users/SnailSploit/repos](https://api.github.com/users/SnailSploit/repos)
- [https://avatars.githubusercontent.com/u/95986478?v=4](https://avatars.githubusercontent.com/u/95986478?v=4)
- [https://api.github.com/users/SnailSploit/events%7B/privacy%7D](https://api.github.com/users/SnailSploit/events%7B/privacy%7D)

## Related threats

- [CairoSVG quadratic-time DoS parsing crafted SVG path](https://junglewise.ai/threats/cve-2026-107378-cairosvg-quadratic-time-dos-parsing-a-crafted-svg-path)
- [CairoSVG improperly processes SVG files loaded from external resources](https://junglewise.ai/threats/cve-2023-27586-cairosvg-improperly-processes-svg-files-loaded-from-external)
- [Regular Expression Denial of Service in CairoSVG](https://junglewise.ai/threats/cve-2021-21236-regular-expression-denial-of-service-in-cairosvg)