{"id":"CVE-2021-21236","aliases":["ALPINE-CVE-2021-21236","DEBIAN-CVE-2021-21236","EUVD-2021-0039","GHSA-hq37-853p-g5cf","MGASA-2021-0149","PYSEC-2021-5","UBUNTU-CVE-2021-21236","openSUSE-SU-2023:0260-1","openSUSE-SU-2023:0272-1","openSUSE-SU-2024:13218-1","openSUSE-SU-2026:11989-1"],"status":"published","title":"Regular Expression Denial of Service in CairoSVG","description":"CairoSVG is a Python (pypi) package. CairoSVG is an SVG converter based on Cairo. In CairoSVG before version 2.5.1, there is a regular expression denial of service (REDoS) vulnerability. When processing SVG files, the python package CairoSVG uses two regular expressions which are vulnerable to Regular Expression Denial of Service (REDoS). If an attacker provides a malicious SVG, it can make cairosvg get stuck processing the file for a very long time. This is fixed in version 2.5.1. See Referenced GitHub advisory for more information.","severity":{"version":"3.1","score":5.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.01368,"percentile":0.72239,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-400"],"published":"2021-01-06T16:57:50Z","modified":"2026-11-06T13:49:14Z","fixes":[{"ecosystem":"PyPI","package":"cairosvg","fixed_in":["2.5.1"],"sources":["ghsa","osv"]},{"ecosystem":"Alpine:v3.18","package":"py3-cairosvg","fixed_in":["2.5.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"py3-cairosvg","fixed_in":["2.5.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"py3-cairosvg","fixed_in":["2.5.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"py3-cairosvg","fixed_in":["2.5.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"py3-cairosvg","fixed_in":["2.5.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"py3-cairosvg","fixed_in":["2.5.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"py3-cairosvg","fixed_in":["2.5.1-r0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"cairosvg","fixed_in":["2.5.0-1.1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"cairosvg","fixed_in":["2.5.0-1.1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"cairosvg","fixed_in":["2.5.0-1.1"],"sources":["osv"]},{"ecosystem":"Mageia:7","package":"python-cairosvg","fixed_in":["2.2.1-1.1.mga7"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"cairosvg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"py3-cairosvg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"py3-cairosvg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"py3-cairosvg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"py3-cairosvg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"py3-cairosvg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"py3-cairosvg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"py3-cairosvg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.1-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"cairosvg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.0-1.1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"cairosvg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.0-1.1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"cairosvg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.0-1.1"}]}]},{"source":"osv","ecosystem":"PyPI","package":"cairosvg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.1"}]}],"versions":["0.1","0.1.1","0.1.2","0.2","0.3","0.3.1","0.4","0.4.1","0.4.2","0.4.3","0.4.4","0.5","1.0","1.0.1","1.0.10","1.0.11","1.0.12","1.0.13","1.0.14","1.0.15","1.0.16","1.0.17","1.0.18","1.0.19","1.0.2","1.0.20","1.0.21","1.0.22","1.0.3","1.0.4","1.0.5","1.0.6","1.0.7","1.0.8","1.0.9","2.0.0","2.0.0rc1","2.0.0rc2","2.0.0rc3","2.0.0rc4","2.0.0rc5","2.0.0rc6","2.0.1","2.0.2","2.0.3","2.1.0","2.1.1","2.1.2","2.1.3","2.2.0","2.2.1","2.3.0","2.3.1","2.4.0","2.4.1","2.4.2","2.5.0"]},{"source":"osv","ecosystem":"Mageia:7","package":"python-cairosvg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.1-1.1.mga7"}]}]},{"source":"osv","ecosystem":"PyPI","package":"cairosvg","ranges":[{"type":"GIT","events":[{"introduced":"0"},{"fixed":"cfc9175e590531d90384aa88845052de53d94bf3"}]},{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.1"}]}],"versions":["0.1","0.1.1","0.1.2","0.2","0.3","0.3.1","0.4","0.4.1","0.4.2","0.4.3","0.4.4","0.5","1.0","1.0.1","1.0.2","1.0.3","1.0.4","1.0.5","1.0.6","1.0.7","1.0.8","1.0.9","1.0.10","1.0.11","1.0.12","1.0.13","1.0.14","1.0.15","1.0.16","1.0.17","1.0.18","1.0.19","1.0.20","1.0.21","1.0.22","2.0.0rc1","2.0.0rc2","2.0.0rc3","2.0.0rc4","2.0.0rc5","2.0.0rc6","2.0.0","2.0.1","2.0.2","2.0.3","2.1.0","2.1.1","2.1.2","2.1.3","2.2.0","2.2.1","2.3.0","2.3.1","2.4.0","2.4.1","2.4.2","2.5.0"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"cairosvg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4.0-2","2.4.2-1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"cairosvg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.7.1-1","2.7.1-2"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"cairosvg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.8.2-1","2.9.0-1","2.9.0-2"]},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP5","package":"python-CairoSVG","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.2-bp155.3.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"python-CairoSVG","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.2-bp155.3.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP4","package":"python-CairoSVG","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.2-bp154.2.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"python-CairoSVG","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.2-bp154.2.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-CairoSVG","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.0-1.3"}]}],"bundled":2}],"products":[{"vendor":"courtbouillon","product":"cairosvg"},{"vendor":"kozea","product":"cairosvg"}],"references":[{"url":"https://github.com/Kozea/CairoSVG/security/advisories/GHSA-hq37-853p-g5cf","tags":["x_refsource_CONFIRM","x_transferred","Exploit","Third Party Advisory","evidence","web","advisory","report"]},{"url":"https://pypi.org/project/CairoSVG/","tags":["x_refsource_MISC","x_transferred","Product","Third Party Advisory","package","report"]},{"url":"https://github.com/Kozea/CairoSVG/commit/cfc9175e590531d90384aa88845052de53d94bf3","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web","report"]},{"url":"https://github.com/Kozea/CairoSVG/releases/tag/2.5.1","tags":["x_refsource_MISC","x_transferred","Release Notes","Third Party Advisory","advisory","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-21236","tags":["advisory"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/cairosvg/PYSEC-2021-5.yaml","tags":["web"]},{"url":"https://pypi.org/project/CairoSVG","tags":["web"]},{"url":"https://github.com/advisories/GHSA-hq37-853p-g5cf","tags":["advisory"]},{"url":"https://security.alpinelinux.org/vuln/CVE-2021-21236","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2021-21236","tags":["advisory"]},{"url":"https://github.com/Kozea/CairoSVG","tags":["package"]},{"url":"https://advisories.mageia.org/MGASA-2021-0149.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=28122","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-21236","tags":["report"]},{"url":"https://github.com/Kozea/CairoSVG/commit/063185b60588a41d4df661ad70f9f7b699901abc","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-21236","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/2GIY4HBHI7WUBHUAMEZKWBMEPOUYNCTU/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1180648","tags":["report"]},{"url":"https://bugzilla.suse.com/1209538","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2021-21236","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-27586","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/74KEOEJKIQ5UHFG7M5KN7X37WT37PVYX/","tags":["advisory"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2021-21236","title":"Regular Expression Denial of Service in CairoSVG","description":"CairoSVG is a Python (pypi) package. CairoSVG is an SVG converter based on Cairo. In CairoSVG before version 2.5.1, there is a regular expression denial of service (REDoS) vulnerability. When processing SVG files, the python package CairoSVG uses two regular expressions which are vulnerable to Regular Expression Denial of Service (REDoS). If an attacker provides a malicious SVG, it can make cairosvg get stuck processing the file for a very long time. This is fixed in version 2.5.1. See Referenced GitHub advisory for more information.","status":"published","published":"2021-01-06T17:00:19Z","modified":"2024-08-03T18:09:15.166Z","cvss":[{"version":"3.1","score":5.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:32:59.802172Z"}],"euvd":[{"id":"EUVD-2021-0039","description":"CairoSVG is a Python (pypi) package. CairoSVG is an SVG converter based on Cairo. In CairoSVG before version 2.5.1, there is a regular expression denial of service (REDoS) vulnerability. When processing SVG files, the python package CairoSVG uses two regular expressions which are vulnerable to Regular Expression Denial of Service (REDoS). If an attacker provides a malicious SVG, it can make cairosvg get stuck processing the file for a very long time. This is fixed in version 2.5.1. See Referenced GitHub advisory for more information.","status":"published","published":"2021-01-06T17:00:19Z","modified":"2024-08-03T18:09:15Z","cvss":[{"version":"3.1","score":5.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-03T03:25:06.913643Z"}],"ghsa":[{"id":"GHSA-hq37-853p-g5cf","title":"Regular Expression Denial of Service in CairoSVG","description":"# Doyensec Vulnerability Advisory \n\n* Regular Expression Denial of Service (REDoS) in cairosvg\n* Affected Product: CairoSVG v2.0.0+\n* Vendor: https://github.com/Kozea\n* Severity: Medium\n* Vulnerability Class: Denial of Service\n* Author(s): Ben Caller ([Doyensec](https://doyensec.com))\n\n## Summary\n\nWhen processing SVG files, the python package CairoSVG uses two regular expressions which are vulnerable to Regular Expression Denial of Service (REDoS).\nIf an attacker provides a malicious SVG, it can make cairosvg get stuck processing the file for a very long time.\n\n## Technical description\n\nThe vulnerable regular expressions are\n\nhttps://github.com/Kozea/CairoSVG/blob/9c4a982b9a021280ad90e89707eacc1d114e4ac4/cairosvg/colors.py#L190-L191\n\nThe section between 'rgb(' and the final ')' contains multiple overlapping groups.\n\nSince all three infinitely repeating groups accept spaces, a long string of spaces causes catastrophic backtracking when it is not followed by a closing parenthesis.\n\nThe complexity is cubic, so doubling the length of the malicious string of spaces makes processing take 8 times as long.\n\n## Reproduction steps\n\nCreate a malicious SVG of the form:\n\n    \u003csvg width=\"1\" height=\"1\"\u003e\u003crect fill=\"rgb(                     ;\"/\u003e\u003c/svg\u003e\n\nwith the following code:\n\n    '\u003csvg width=\"1\" height=\"1\"\u003e\u003crect fill=\"rgb(' + (' ' * 3456) + ';\"/\u003e\u003c/svg\u003e'\n\nNote that there is no closing parenthesis before the semi-colon.\n\nRun cairosvg e.g.:\n\n    cairosvg cairo-redos.svg -o x.png\n\nand notice that it hangs at 100% CPU. Increasing the number of spaces increases the processing time with cubic complexity.\n\n## Remediation\n\nFix the regexes to avoid overlapping parts. Perhaps remove the [ \\n\\r\\t]* groups from the regex, and use .strip() on the returned capture group.\n\n## Disclosure timeline\n\n- 2020-12-30: Vulnerability disclosed via email to CourtBouillon","status":"published","published":"2021-01-06T16:57:50Z","modified":"2024-09-13T17:42:16Z","cvss":[{"version":"4.0","score":7.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P","level":"high"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:38:02.773864Z"}],"nvd":[{"id":"CVE-2021-21236","description":"CairoSVG is a Python (pypi) package. CairoSVG is an SVG converter based on Cairo. In CairoSVG before version 2.5.1, there is a regular expression denial of service (REDoS) vulnerability. When processing SVG files, the python package CairoSVG uses two regular expressions which are vulnerable to Regular Expression Denial of Service (REDoS). If an attacker provides a malicious SVG, it can make cairosvg get stuck processing the file for a very long time. This is fixed in version 2.5.1. See Referenced GitHub advisory for more information.","status":"published","published":"2021-01-06T17:15:23.733Z","modified":"2026-06-17T03:35:05.927Z","cvss":[{"version":"3.1","score":5.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"secondary"},{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:06:49.284888Z"}],"osv":[{"id":"ALPINE-CVE-2021-21236","description":"CairoSVG is a Python (pypi) package. CairoSVG is an SVG converter based on Cairo. In CairoSVG before version 2.5.1, there is a regular expression denial of service (REDoS) vulnerability. When processing SVG files, the python package CairoSVG uses two regular expressions which are vulnerable to Regular Expression Denial of Service (REDoS). If an attacker provides a malicious SVG, it can make cairosvg get stuck processing the file for a very long time. This is fixed in version 2.5.1. See Referenced GitHub advisory for more information.","status":"published","published":"2021-01-06T17:15:23.733Z","modified":"2026-11-03T06:32:38.116239593Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-03T07:17:20.312441Z"},{"id":"CVE-2021-21236","description":"CairoSVG is a Python (pypi) package. CairoSVG is an SVG converter based on Cairo. In CairoSVG before version 2.5.1, there is a regular expression denial of service (REDoS) vulnerability. When processing SVG files, the python package CairoSVG uses two regular expressions which are vulnerable to Regular Expression Denial of Service (REDoS). If an attacker provides a malicious SVG, it can make cairosvg get stuck processing the file for a very long time. This is fixed in version 2.5.1. See Referenced GitHub advisory for more information.","status":"published","published":"2021-01-06T17:15:23.733Z","modified":"2026-10-20T10:54:28.062304383Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:44:18.004149Z"},{"id":"DEBIAN-CVE-2021-21236","description":"CairoSVG is a Python (pypi) package. CairoSVG is an SVG converter based on Cairo. In CairoSVG before version 2.5.1, there is a regular expression denial of service (REDoS) vulnerability. When processing SVG files, the python package CairoSVG uses two regular expressions which are vulnerable to Regular Expression Denial of Service (REDoS). If an attacker provides a malicious SVG, it can make cairosvg get stuck processing the file for a very long time. This is fixed in version 2.5.1. See Referenced GitHub advisory for more information.","status":"published","published":"2021-01-06T17:15:23.733Z","modified":"2026-10-23T18:03:11.681434887Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:34.637046Z"},{"id":"GHSA-hq37-853p-g5cf","title":"Regular Expression Denial of Service in CairoSVG","description":"# Doyensec Vulnerability Advisory \n\n* Regular Expression Denial of Service (REDoS) in cairosvg\n* Affected Product: CairoSVG v2.0.0+\n* Vendor: https://github.com/Kozea\n* Severity: Medium\n* Vulnerability Class: Denial of Service\n* Author(s): Ben Caller ([Doyensec](https://doyensec.com))\n\n## Summary\n\nWhen processing SVG files, the python package CairoSVG uses two regular expressions which are vulnerable to Regular Expression Denial of Service (REDoS).\nIf an attacker provides a malicious SVG, it can make cairosvg get stuck processing the file for a very long time.\n\n## Technical description\n\nThe vulnerable regular expressions are\n\nhttps://github.com/Kozea/CairoSVG/blob/9c4a982b9a021280ad90e89707eacc1d114e4ac4/cairosvg/colors.py#L190-L191\n\nThe section between 'rgb(' and the final ')' contains multiple overlapping groups.\n\nSince all three infinitely repeating groups accept spaces, a long string of spaces causes catastrophic backtracking when it is not followed by a closing parenthesis.\n\nThe complexity is cubic, so doubling the length of the malicious string of spaces makes processing take 8 times as long.\n\n## Reproduction steps\n\nCreate a malicious SVG of the form:\n\n    \u003csvg width=\"1\" height=\"1\"\u003e\u003crect fill=\"rgb(                     ;\"/\u003e\u003c/svg\u003e\n\nwith the following code:\n\n    '\u003csvg width=\"1\" height=\"1\"\u003e\u003crect fill=\"rgb(' + (' ' * 3456) + ';\"/\u003e\u003c/svg\u003e'\n\nNote that there is no closing parenthesis before the semi-colon.\n\nRun cairosvg e.g.:\n\n    cairosvg cairo-redos.svg -o x.png\n\nand notice that it hangs at 100% CPU. Increasing the number of spaces increases the processing time with cubic complexity.\n\n## Remediation\n\nFix the regexes to avoid overlapping parts. Perhaps remove the [ \\n\\r\\t]* groups from the regex, and use .strip() on the returned capture group.\n\n## Disclosure timeline\n\n- 2020-12-30: Vulnerability disclosed via email to CourtBouillon","status":"published","published":"2021-01-06T16:57:50Z","modified":"2026-09-10T03:49:14.069813467Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"},{"version":"4.0","score":7.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P","level":"high"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T15:46:49.28217Z"},{"id":"UBUNTU-CVE-2021-21236","description":"CairoSVG is a Python (pypi) package. CairoSVG is an SVG converter based on Cairo. In CairoSVG before version 2.5.1, there is a regular expression denial of service (REDoS) vulnerability. When processing SVG files, the python package CairoSVG uses two regular expressions which are vulnerable to Regular Expression Denial of Service (REDoS). If an attacker provides a malicious SVG, it can make cairosvg get stuck processing the file for a very long time. This is fixed in version 2.5.1. See Referenced GitHub advisory for more information.","status":"published","published":"2021-01-06T17:15:00Z","modified":"2026-11-06T13:49:14.81819883Z","cvss":[{"version":"3.1","score":5.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H","level":"medium"},{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-06T14:21:57.100949Z"},{"id":"MGASA-2021-0149","title":"Updated python-cairosvg packages fix security vulnerability","description":"When processing SVG files, the python package CairoSVG uses two regular\nexpressions which are vulnerable to Regular Expression Denial of Service\n(REDoS). If an attacker provides a malicious SVG, it can make cairosvg\nget stuck processing the file for a very long time (CVE-2021-21236).\n","status":"published","published":"2021-03-21T10:43:43Z","modified":"2026-04-16T04:40:51.783677182Z","updated_at":"2026-11-02T15:49:41.509337Z"},{"id":"openSUSE-SU-2023:0260-1","title":"Security update for python-CairoSVG","description":"This update for python-CairoSVG fixes the following issues:\n\n- CVE-2023-27586: Don't allow fetching external files unless explicitly asked for. (boo#1209538)\n\n- Update to version 2.5.2\n\n  * Fix marker path scale\n\n- Update to version 2.5.1 (boo#1180648, CVE-2021-21236):\n\n  * Security fix: When processing SVG files, CairoSVG was using two\n    regular expressions which are vulnerable to Regular Expression \n    Denial of Service (REDoS). If an attacker provided a malicious \n    SVG, it could make CairoSVG get stuck processing the file for a \n    very long time.\n  * Fix marker positions for unclosed paths\n  * Follow hint when only output_width or output_height is set\n  * Handle opacity on raster images\n  * Don’t crash when use tags reference unknown tags\n  * Take care of the next letter when A/a is replaced by l\n  * Fix misalignment in node.vertices\n\n- Updates for version 2.5.0.\n\n  * Drop support of Python 3.5, add support of Python 3.9.\n  * Add EPS export\n  * Add background-color, negate-colors, and invert-images options\n  * Improve support for font weights\n  * Fix opacity of patterns and gradients\n  * Support auto-start-reverse value for orient\n  * Draw images contained in defs\n  * Add Exif transposition support\n  * Handle dominant-baseline\n  * Support transform-origin\n","status":"published","published":"2023-09-25T12:02:25Z","modified":"2026-02-04T03:11:13.29582Z","updated_at":"2026-11-02T16:58:32.653274Z"},{"id":"openSUSE-SU-2023:0272-1","title":"Security update for python-CairoSVG","description":"This update for python-CairoSVG fixes the following issues:\n\n- CVE-2023-27586: Don't allow fetching external files unless explicitly asked for.  (boo#1209538)\n\n- Update to version 2.5.2\n\n  * Fix marker path scale\n\n- Update to version 2.5.1 (boo#1180648, CVE-2021-21236):\n\n  * Security fix: When processing SVG files, CairoSVG was using two\n    regular expressions which are vulnerable to Regular Expression \n    Denial of Service (REDoS). If an attacker provided a malicious \n    SVG, it could make CairoSVG get stuck processing the file for a \n    very long time.\n\n  * Fix marker positions for unclosed paths\n  * Follow hint when only output_width or output_height is set\n  * Handle opacity on raster images\n  * Don’t crash when use tags reference unknown tags\n  * Take care of the next letter when A/a is replaced by l\n  * Fix misalignment in node.vertices\n\n- Updates for version 2.5.0.\n\n  * Drop support of Python 3.5, add support of Python 3.9.\n  * Add EPS export\n  * Add background-color, negate-colors, and invert-images options\n  * Improve support for font weights\n  * Fix opacity of patterns and gradients\n  * Support auto-start-reverse value for orient\n  * Draw images contained in defs\n  * Add Exif transposition support\n  * Handle dominant-baseline\n  * Support transform-origin\n","status":"published","published":"2023-09-25T22:02:13Z","modified":"2026-02-04T03:12:20.461124Z","updated_at":"2026-11-02T16:58:32.653274Z"},{"id":"openSUSE-SU-2024:13218-1","title":"python310-CairoSVG-2.7.1-1.1 on GA media","description":"These are all security issues fixed in the python310-CairoSVG-2.7.1-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:31:24.080507Z","updated_at":"2026-11-02T16:58:36.025801Z"},{"id":"openSUSE-SU-2026:11989-1","title":"python313-CairoSVG-2.9.0-1.3 on GA media","description":"These are all security issues fixed in the python313-CairoSVG-2.9.0-1.3 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-10-04T00:00:00Z","modified":"2026-10-05T10:15:29.788420114Z","updated_at":"2026-11-02T16:58:40.245664Z"},{"id":"PYSEC-2021-5","description":"CairoSVG is a Python (pypi) package. CairoSVG is an SVG converter based on Cairo. In CairoSVG before version 2.5.1, there is a regular expression denial of service (REDoS) vulnerability. When processing SVG files, the python package CairoSVG uses two regular expressions which are vulnerable to Regular Expression Denial of Service (REDoS). If an attacker provides a malicious SVG, it can make cairosvg get stuck processing the file for a very long time. This is fixed in version 2.5.1. See Referenced GitHub advisory for more information.","status":"published","published":"2021-01-06T17:15:00Z","modified":"2023-11-08T04:04:38.945453Z","updated_at":"2026-11-02T15:52:53.119977Z"}]}}