CVE-2026-107378
CairoSVG: Quadratic-time DoS parsing a crafted SVG <path>
CairoSVG is an SVG converter based on Cairo, a 2D graphics library. Prior to 2.9.1, rendering an attacker-controlled SVG with a path containing many segments can cause quadratic CPU consumption in cairosvg/path.py. The path tokenizer repeatedly slices and rescans the remaining path data, while draw_markers drains node.vertices with node.vertices.pop(0), causing repeated linear-time work. The svg2png, svg2pdf, and svg2ps APIs reach these operations during ordinary rendering, allowing a sub-megabyte SVG to consume substantial CPU and deny service to a rendering application. This issue is fixed in version 2.9.1.
| CWE | CWE-407 |
| Vendor | kozea |
| Product | cairosvg |
| Published | Oct 8, 2026 |
| Last Updated | Oct 8, 2026 |
Get instant alerts for kozea cairosvg
Be the first to know when new unknown vulnerabilities affecting kozea cairosvg are published — delivered to Slack, Telegram or Discord.