Read the docs
TI-2021-04339 Aliases CVE-2021-21236GHSA-hq37-853p-g5cf

Regular Expression Denial of Service in CairoSVG

Priority LOW 28CWE-400Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Required
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-400.

Summary

CairoSVG is a Python (pypi) package. CairoSVG is an SVG converter based on Cairo. In CairoSVG before version 2.5.1, there is a regular expression denial of service (REDoS) vulnerability. When processing SVG files, the python package CairoSVG uses two regular expressions which are vulnerable to Regular Expression Denial of Service (REDoS). If an attacker provides a malicious SVG, it can make cairosvg get stuck processing the file for a very long time. This is fixed in version 2.5.1. See Referenced GitHub advisory for more information.

Why it matters now

EPSS 0.01368 72nd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed CairoSVG (Kozea): 2.5.1CairoSVG (PyPI): 2.5.1

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
KozeaCairoSVGbefore 2.5.12.5.1Patch availableCNA
—CairoSVG (PyPI)before 2.5.12.5.1Patch availableGHSA-hq37-853p-g5cf
  • CairoSVG VendorKozea Affected before 2.5.1 Fixed in 2.5.1 Patch available CNA
  • CairoSVG (PyPI) Vendor— Affected before 2.5.1 Fixed in 2.5.1 Patch available GHSA-hq37-853p-g5cf

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:courtbouillon:cairosvg:*:*:*:*:*:*:*:*before 2.5.1VulnerableCourtbouillon
  • cpe:2.3:a:courtbouillon:cairosvg:*:*:*:*:*:*:*:* Versions before 2.5.1 Vulnerable ·Courtbouillon

Remediation

  • Fix · CNA CairoSVG (Kozea) Fixed in 2.5.1
  • Fix · GHSA-hq37-853p-g5cf CairoSVG (PyPI) Fixed in 2.5.1 Advisory →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-21236
  2. 2026-10-03 Alias added: GHSA-hq37-853p-g5cf

References

Exploit 1

Patch 1

Advisory 3

Other 3

  • TI-2026-69644 Inefficient path parsing in CairoSVG enables denial of service CVSS 4.0HIGH 8.7
  • TI-2026-24451 CairoSVG vulnerable to Exponential DoS via recursive <use> element amplification CVSS 3.1HIGH 7.5
  • TI-2025-42134 WeasyPrint Vulnerable to Server-Side Request Forgery (SSRF) Protection Bypass via HTTP Redirect CVSS 3.1HIGH 7.5
  • TI-2026-36607 WeasyPrint: CSS Injection via Presentational Hints CVSS 3.1MEDIUM 6.5
  • TI-2026-39778 WeasyPrint restrictive URL fetcher bypass allows local file read and SSRF CVSS 3.1MEDIUM 6.2
  • TI-2023-12296 CairoSVG improperly processes SVG files loaded from external resources CVSS 3.1CRITICAL 9.9
See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences