CVE-2026-31899

CairoSVG vulnerable to Exponential DoS via recursive <use> element amplification

CairoSVG is an SVG converter based on Cairo, a 2D graphics library. Prior to Kozea/CairoSVG has exponential denial of service via recursive <use> element amplification in cairosvg/defs.py. This causes CPU exhaustion from a small input.

Affected

Kozea · CairoSVG

CVSS v3.1 GITHUB

7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS

0.53% chance of exploitation in the next 30 days, 44th percentile

Published

2026-03-13

Updated

2026-03-16

Proof-of-concept exploits (2)

• advisories/GHSA-f38f-5xpm-9r7c
• SnailSploit/CVE-2026-318990★ · 2026-05-08

Security advisories

• Kozea/CairoSVG/security/advisories/GHSA-f38f-5xpm-9r7c
• Kozea/CairoSVG/commit/6dde8685ed3f19837767bce7a13a5491e3d0e0bf

References

• CVE Record
• NVD entry

Related

• CVE-2025-11171
• CVE-2025-11174
• CVE-2025-12030
• CVE-2025-12163
• CVE-2025-9776
• CVE-2026-1208