CairoSVG: Quadratic-time denial of service when parsing crafted SVG path data
Summary
CairoSVG is a Python library that converts SVG files based on Cairo. Versions before 2.9.1 have a path-parsing flaw: an SVG with a path containing many segments causes quadratic CPU consumption during rendering. An unauthenticated attacker can supply a sub-megabyte SVG to an application that renders untrusted files and exhaust CPU, causing denial of service. No confidentiality or integrity impact is known.
Affected
- Kozea CairoSVG versions before 2.9.1
- Applications that call svg2png, svg2pdf or svg2ps on untrusted SVG input
Fixed in
- Fixed in CairoSVG 2.9.1 (GHSA-c3jg-qh8m-j3h2)
Workaround
- No vendor workaround documented; upgrade is the remedy.
- Interim measures (own suggestions, not vendor guidance): reject or restrict SVG uploads from untrusted users, cap upload size, and run rendering in an isolated worker with CPU and time limits.
Exploitation
- CISA SSVC: exploitation status 'poc', automatable: yes, technical impact: partial.
- A public proof of concept is described by a third-party project; not independently verified.
- No evidence of active exploitation in the wild found.
Our recommendation
- Inventory Python applications and containers for cairosvg versions below 2.9.1.
- Upgrade to cairosvg 2.9.1 or later and rebuild lock files and images.
- Prioritise internet-facing services that render user-supplied SVG; apply interim limits until patched.
- Monitor CPU usage of rendering services for unusual spikes.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-c3jg-qh8m-j3h2 github.com
- CairoSVG release 2.9.1 github.com
- Fix commit: regex-based path tokenizer github.com
- Fix commit: deque for vertices github.com
- SUSE security update SUSE-SU-2026:4949-1 vulners.com
- Ubuntu CVE tracker ubuntu.com
- GitLab advisory database entry advisories.gitlab.com
- VulDB entry 415518 vuldb.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 05:15.
Original description (NVD)
CairoSVG is an SVG converter based on Cairo, a 2D graphics library. Prior to 2.9.1, rendering an attacker-controlled SVG with a path containing many segments can cause quadratic CPU consumption in cairosvg/path.py. The path tokenizer repeatedly slices and rescans the remaining path data, while draw_markers drains node.vertices with node.vertices.pop(0), causing repeated linear-time work. The svg2png, svg2pdf, and svg2ps APIs reach these operations during ordinary rendering, allowing a sub-megabyte SVG to consume substantial CPU and deny service to a rendering application. This issue is fixed in version 2.9.1.
NVD references (5)
- https://github.com/Kozea/CairoSVG/commit/9d63f049f9988d0ddda3eb94564ac3a50a286523
- https://github.com/Kozea/CairoSVG/commit/a4d585eb374724b79676e9cceaa9e9a1a4358565
- https://github.com/Kozea/CairoSVG/releases/tag/2.9.1
- https://github.com/Kozea/CairoSVG/security/advisories/GHSA-c3jg-qh8m-j3h2
- https://github.com/Kozea/CairoSVG/security/advisories/GHSA-c3jg-qh8m-j3h2
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.