CVE-2026-31899
Description
A flaw was found in CairoSVG, an SVG converter. A remote attacker could exploit this vulnerability by submitting a specially crafted SVG file that contains recursive <use> elements. This can lead to an exponential increase in processing time and CPU exhaustion, resulting in a Denial of Service (DoS) for the system.
Statement
This is an IMPORTANT denial of service vulnerability in CairoSVG, affecting systems that process untrusted SVG input. The flaw allows an attacker to trigger exponential CPU exhaustion through recursive <use> element amplification. Red Hat products that include python-cairosvg and process untrusted SVG content are affected.
Mitigation
To mitigate this issue, avoid processing untrusted SVG files with CairoSVG. If processing untrusted SVG content is unavoidable, consider isolating the CairoSVG processing within a sandboxed environment to limit potential resource exhaustion.
Understanding the Weakness (CWE)
Availability
Technical Impact: DoS: Resource Consumption (Other)
If parsed, recursive entity references allow the attacker to expand data exponentially, quickly consuming all system resources.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
