CVE-2026-107378
Description
A flaw was found in CairoSVG. A remote attacker can cause a Denial of Service (DoS) by providing a specially crafted Scalable Vector Graphics (SVG) file containing paths with numerous segments. Inefficient path processing leads to excessive CPU resource consumption during rendering, causing the application to become unresponsive.
Statement
This vulnerability is rated as Important because an unauthenticated remote attacker can exhaust server CPU resources and induce a denial of service by submitting a small, malicious vector graphic. The flaw affects web applications and automated conversion pipelines that ingest untrusted graphic files and render them using CairoSVG without input restrictions. However, CairoSVG is not included in core Red Hat Enterprise Linux channels and is only distributed through community repositories such as EPEL, meaning default enterprise deployments do not include or expose this component.
Understanding the Weakness (CWE)
Availability
Technical Impact: DoS: Resource Consumption (CPU)
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
