Key points
- CVE-2026-107378 affects CairoSVG versions prior to 2.9.1.
- The vulnerability is rated High (CVSS 8.7) and involves quadratic CPU consumption.
- Version 2.9.1 patches the issue by optimizing path tokenization and marker handling.
Security researchers have identified a high-severity denial-of-service vulnerability in CairoSVG, a popular Python library for rendering Scalable Vector Graphics. The flaw, tracked as CVE-2026-107378, allows an attacker to freeze a server by providing a malicious SVG file that consumes excessive processing power.
In plain English
CairoSVG converts SVG files into formats like PNG, PDF, or PostScript. The vulnerability exists in how the library processes complex paths within an SVG. When a file contains a path with many segments, the library performs inefficient operations that multiply the required CPU time. A single SVG file under one megabyte can cause the software to spend tens of seconds processing it. This quadratic growth in resource usage means that doubling the path segments roughly quadruples the processing time, effectively denying service to other users of the application.
The background
According to the National Vulnerability Database, the issue stems from two specific inefficiencies in the `cairosvg/path.py` module. First, the path tokenizer repeatedly slices and rescans the remaining path data string, creating a linear-time operation for each step. Second, the `draw_markers` function drains vertex data using a list operation that is inefficient for removing items from the beginning of a list.
Both flaws are triggered during standard rendering operations such as `svg2png`, `svg2pdf`, and `svg2ps`. The GitHub security advisory notes that an SVG with 200,000 path segments can take approximately 18 seconds to process, making any service that renders user-supplied SVGs a target for denial-of-service attacks.
What changes now
The vendor has released version 2.9.1, which fixes the vulnerability. The update addresses the quadratic CPU consumption by optimizing the path tokenization and marker handling processes. Applications using CairoSVG should update to this version immediately to prevent potential service disruptions.
What to do and how to stay safe: CairoSVG
- Audit your Python environments to identify any installations of CairoSVG versions prior to 2.9.1.
- Update the library to version 2.9.1 or later once the vendor provides the update.
- Implement resource limits on services that render user-supplied SVG files to mitigate the impact of unpatched systems.
- Monitor server CPU usage for unusual spikes that may indicate an ongoing denial-of-service attempt.
Step-by-step guide: Out-of-Band Patches: Meaning, Risks, and Deployment Reality
General security guidance from the Patch Herald newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is CVE-2026-107378?
It is a high-severity denial-of-service vulnerability in CairoSVG that allows malicious SVG files to cause quadratic CPU consumption.
Which versions of CairoSVG are affected?
All versions prior to 2.9.1 are vulnerable to this issue.
Is there a patch available?
Yes, version 2.9.1 fixes the vulnerability by optimizing path tokenization and marker handling.
