CVE-2026-31899: Courtbouillon CairoSVG DOS Vulnerability

CVE-2026-31899 Overview

CVE-2026-31899 is a denial of service vulnerability in CairoSVG, an SVG converter based on the Cairo 2D graphics library. The vulnerability exists in cairosvg/defs.py where recursive <use> element amplification can cause exponential CPU exhaustion from a relatively small input file. This allows attackers to craft malicious SVG files that, when processed by CairoSVG, consume excessive CPU resources and render the application unresponsive.

Critical Impact

Attackers can exploit recursive SVG <use> elements to cause CPU exhaustion denial of service, potentially disrupting services that process user-supplied SVG files with minimal input payload.

Affected Products

• Courtbouillon CairoSVG (versions prior to the security patch)

Discovery Timeline

• 2026-03-13 - CVE-2026-31899 published to NVD
• 2026-03-18 - Last updated in NVD database

Technical Details for CVE-2026-31899

Vulnerability Analysis

This vulnerability is classified as CWE-674 (Uncontrolled Recursion), which occurs when the software does not properly control the amount of recursion that occurs. In CairoSVG, the use() function in cairosvg/defs.py processes SVG <use> elements without limiting the number of referenced elements that can be rendered. SVG <use> elements allow referencing and reusing other SVG elements, and when these references are nested recursively, each level of nesting can reference multiple elements, creating exponential growth in processing requirements.

An attacker can craft a malicious SVG file containing deeply nested or self-referential <use> elements that cause the parser to recursively process an exponentially increasing number of element references. This algorithmic complexity attack enables a small input file to consume disproportionate CPU resources, effectively causing a denial of service condition.

Root Cause

The root cause of this vulnerability is the absence of a limit on the number of referenced elements that can be rendered during SVG processing. The use() function in cairosvg/defs.py would recursively process <use> elements without tracking or limiting the total reference count, allowing exponential amplification through recursive element references.

Attack Vector

This vulnerability is exploitable via network-based attacks where an attacker supplies a maliciously crafted SVG file to any application or service using CairoSVG for SVG processing. Common attack scenarios include:

• Web applications that accept SVG uploads for image conversion
• Document processing systems that render embedded SVG content
• API endpoints that process SVG data for thumbnail generation or format conversion

The attack requires no authentication or user interaction, making it particularly dangerous for internet-facing services.

# Security patch in cairosvg/defs.py - Abort when more than 100k referenced elements are rendered
 
def use(surface, node):
    """Draw the content of another SVG node."""
+    surface.reference_count += 1
+    if not node.unsafe and surface.reference_count > 100_000:
+        raise ValueError('Abort rendering: more than 100 000 referenced elements')
    surface.context.save()
    surface.context.translate(
        size(surface, node.get('x'), 'x'), size(surface, node.get('y'), 'y'))

Source: GitHub Commit Update

# Security patch in cairosvg/surface.py - Abort when more than 100k referenced elements are rendered
        self.cursor_d_position = [0, 0]
        self.text_path_width = 0
        self.tree_cache = {(tree.url, tree.get('id')): tree}
+        self.reference_count = 0
        if parent_surface:
            self.markers = parent_surface.markers
            self.gradients = parent_surface.gradients

Source: GitHub Commit Update

Detection Methods for CVE-2026-31899

Indicators of Compromise

• Abnormally high CPU utilization on systems processing SVG files
• CairoSVG processes becoming unresponsive or timing out during SVG conversion
• Presence of SVG files containing deeply nested or recursive <use> elements
• Error logs showing excessive recursion or memory allocation failures in CairoSVG

Detection Strategies

• Monitor CPU usage patterns for processes invoking CairoSVG libraries
• Implement input validation to detect SVG files with excessive <use> element nesting
• Set up alerting for CairoSVG process timeouts or crashes
• Deploy application-level logging to track SVG processing duration anomalies

Monitoring Recommendations

• Configure resource monitoring for services that process SVG content
• Implement request rate limiting for SVG upload/processing endpoints
• Set processing timeouts for SVG conversion operations
• Monitor for repeated failed SVG processing attempts from the same source

How to Mitigate CVE-2026-31899

Immediate Actions Required

• Update CairoSVG to the latest patched version immediately
• Review and audit any services that accept user-supplied SVG files
• Implement input validation to reject SVG files with excessive complexity
• Configure resource limits (CPU time, memory) for SVG processing operations

Patch Information

Courtbouillon has released a security patch for CairoSVG that addresses this vulnerability by implementing a reference count limit of 100,000 elements. The fix introduces a reference_count attribute on the surface object and checks this counter in the use() function, raising a ValueError when the limit is exceeded. The patch is available via commit 6dde8685ed3f19837767bce7a13a5491e3d0e0bf. For detailed information, see the GitHub Security Advisory.

Workarounds

• Run CairoSVG in a sandboxed environment with strict resource limits
• Implement preprocessing validation to reject SVG files with recursive <use> patterns
• Set CPU and memory limits using containerization or process control mechanisms
• Disable SVG processing features temporarily until the patch can be applied

# Configuration example - Set resource limits for CairoSVG processes
# Using systemd service configuration
[Service]
CPUQuota=50%
MemoryLimit=512M
TimeoutSec=30

# Using Docker resource constraints
docker run --cpus="0.5" --memory="512m" your-cairosvg-service