DEBIAN-CVE-2026-114610

See a problem?
Please try reporting it to the source first.

Source

https://security-tracker.debian.org/tracker/CVE-2026-114610

Import Source

https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-114610.json

JSON Data

https://api.osv.dev/v1/vulns/DEBIAN-CVE-2026-114610

Upstream

CVE-2026-114610

Published

2026-10-22T18:17:28Z

Modified

2026-10-24T09:47:34Z

Severity

6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVSS Calculator

Summary

[none]

Details

fpdf2 is a PDF creation library for Python. From 2.5.0 until 2.8.8, fpdf2's SVGObject.build_xref() passes nested SVG references to GraphicsContext.add_item(), whose default clone=True deep-copy behavior copies the complete referenced graphics tree during FPDF.image() processing. Repeating references at each nesting level makes the in-memory object count and processing work grow exponentially, allowing a small user-controlled SVG to consume excessive CPU and memory, raise MemoryError, fail PDF generation jobs, and reduce or exhaust worker capacity. ResourceAccessPolicy does not prevent the issue because the references are inline and require no external resource, XML entity, local file, or permissive network setting. This issue is fixed in version 2.8.8.

References

https://security-tracker.debian.org/tracker/CVE-2026-114610

Affected packages

Debian:13 / fpdf2

Package

Name: fpdf2
Purl: pkg:deb/debian/fpdf2?arch=source&distro=trixie

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Affected versions

2.*

2.8.3-1

2.8.3-1+deb13u1

2.8.4-1

2.8.4-2

2.8.7-1

2.8.7-2

2.8.8-1

2.8.9-1

Ecosystem specific

{
    "urgency":  "not yet assigned"
}

Database specific

source

"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-114610.json"

Debian:14 / fpdf2