CVE-2026-107378

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-107378
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-107378.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-107378
Aliases
Downstream
Related
Published
2026-10-08T17:59:09Z
Modified
2026-10-28T02:30:40Z
Severity
  • 8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
CairoSVG: Quadratic-time DoS parsing a crafted SVG <path>
Details

CairoSVG is an SVG converter based on Cairo, a 2D graphics library. Prior to 2.9.1, rendering an attacker-controlled SVG with a path containing many segments can cause quadratic CPU consumption in cairosvg/path.py. The path tokenizer repeatedly slices and rescans the remaining path data, while draw_markers drains node.vertices with node.vertices.pop(0), causing repeated linear-time work. The svg2png, svg2pdf, and svg2ps APIs reach these operations during ordinary rendering, allowing a sub-megabyte SVG to consume substantial CPU and deny service to a rendering application. This issue is fixed in version 2.9.1.

Database specific 
{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-407"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/107xxx/CVE-2026-107378.json"
}
References

Affected packages

Git / github.com/kozea/cairosvg

Affected ranges

Type
GIT
Repo
https://github.com/kozea/cairosvg
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
3b7a250c9e955db9c3cdf525d5b5027a9a396201
Fixed
9d63f049f9988d0ddda3eb94564ac3a50a286523
Fixed
a4d585eb374724b79676e9cceaa9e9a1a4358565
Database specific
Show details 
{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "0"
                },
                {
                    "fixed":  "2.9.1"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StringRangeExpression"
        },
        {
            "range":  [
                {
                    "fixed":  "9d63f049f9988d0ddda3eb94564ac3a50a286523"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        },
        {
            "range":  [
                {
                    "fixed":  "a4d585eb374724b79676e9cceaa9e9a1a4358565"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        },
        {
            "original_tag":  "2.9.1",
            "range":  [
                {
                    "fixed":  "3b7a250c9e955db9c3cdf525d5b5027a9a396201"
                }
            ],
            "source":  "REFERENCES_TAG"
        }
    ]
}

Affected versions

0.*
0.1
0.1.1
0.2
0.3
0.3.1
0.4
0.4.1
0.4.2
0.4.3
0.4.4
0.5
1.*
1.0
1.0.1
1.0.10
1.0.11
1.0.12
1.0.13
1.0.14
1.0.15
1.0.16
1.0.17
1.0.18
1.0.19
1.0.2
1.0.3
1.0.4
1.0.5
1.0.6
1.0.7
1.0.8
1.0.9
2.*
2.0.0
2.0.0-rc6
2.0.0rc1
2.0.0rc2
2.0.0rc3
2.0.0rc4
2.0.0rc5
2.0.0rc6
2.0.1
2.0.2
2.0.3
2.1.0
2.1.1
2.1.2
2.1.3
2.2.0
2.2.1
2.3.0
2.3.1
2.4.0
2.4.1
2.4.2
2.5.0
2.5.1
2.5.2
2.6.0
2.7.0
2.7.1
2.8.0
2.8.1
2.8.2
2.9.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-107378.json"