CVE-2026-107378 in CairoSVG
Summary
by MITRE • 10/08/2026
CairoSVG is an SVG converter based on Cairo, a 2D graphics library. Prior to 2.9.1, rendering an attacker-controlled SVG with a path containing many segments can cause quadratic CPU consumption in cairosvg/path.py. The path tokenizer repeatedly slices and rescans the remaining path data, while draw_markers drains node.vertices with node.vertices.pop(0), causing repeated linear-time work. The svg2png, svg2pdf, and svg2ps APIs reach these operations during ordinary rendering, allowing a sub-megabyte SVG to consume substantial CPU and deny service to a rendering application. This issue is fixed in version 2.9.1.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/08/2026
CairoSVG serves as a widely utilized Python library for converting Scalable Vector Graphics into raster images or other vector formats, leveraging the Cairo graphics engine under the hood. A critical performance vulnerability was identified within versions prior to 2.9.1 that exposes the rendering process to resource exhaustion attacks through specifically crafted input files. This flaw is categorized under CWE-400, which describes uncontrolled resource consumption, and aligns with ATT&CK technique T1496, representing Resource Hijacking where an attacker consumes system resources to degrade service availability for legitimate users. The vulnerability stems from algorithmic inefficiencies in the path parsing logic rather than a traditional memory corruption or code execution flaw, yet it carries significant operational risk due to its potential for denial of service.
The technical root cause lies within the cairosvg/path.py module where two distinct mechanisms contribute to quadratic CPU consumption when processing SVG paths with numerous segments. First, the path tokenizer employs an approach that repeatedly slices and rescans the remaining path data as it iterates through commands. This results in a time complexity proportional to the square of the number of path elements rather than linear growth. Second, the draw_markers function utilizes node.vertices.pop(0) to process vertex data. In Python lists, removing an element from index zero requires shifting all subsequent elements one position to the left, creating another linear-time operation that is executed repeatedly within a loop. When combined with paths containing many segments, these operations compound rapidly, leading to exponential increases in processing time relative to file size or complexity.
The operational impact of this vulnerability allows for effective denial-of-service attacks against any application utilizing CairoSVG's rendering APIs such as svg2png, svg2pdf, and svg2ps. An attacker can construct a sub-megabyte SVG file containing paths with sufficient segments to trigger the quadratic behavior without requiring excessive bandwidth or storage space. Upon ingestion by an affected system, this malicious input causes the CPU usage to spike dramatically, potentially freezing threads, exhausting server resources, or causing timeouts in web services that rely on dynamic image generation. Because the attack vector involves standard rendering functions, it can be triggered remotely if the service accepts user-uploaded SVGs for conversion without proper validation or resource limits.
Mitigation strategies primarily involve upgrading to version 2.9.1 of CairoSVG where these algorithmic inefficiencies have been addressed through optimized data structures and processing logic that eliminate the repeated slicing and linear-time removal operations. For environments unable to immediately upgrade, defensive measures should include implementing strict file size limits on uploaded SVGs, enforcing timeouts on rendering processes to prevent indefinite CPU consumption, and validating input complexity before passing it to the parser. Additionally, deploying rate limiting or resource quotas at the application layer can help mitigate the impact of such attacks by ensuring that a single request cannot monopolize system resources for an extended period.