Nixpkgs Security Tracker

Published

Permalink CVE-2026-31899

updated 1 day, 6 hours ago by @LeSuisse Activity log

Created automatic suggestion 2 days, 20 hours ago
@LeSuisse accepted 1 day, 6 hours ago
@LeSuisse published on GitHub 1 day, 6 hours ago

CairoSVG vulnerable to Exponential DoS via recursive <use> element amplification

CairoSVG is an SVG converter based on Cairo, a 2D graphics library. Prior to Kozea/CairoSVG has exponential denial of service via recursive <use> element amplification in cairosvg/defs.py. This causes CPU exhaustion from a small input.

References

https://github.com/Kozea/CairoSVG/security/advisories/GHSA-f38f-5xpm-9r7c x_refsource_CONFIRM
https://github.com/Kozea/CairoSVG/commit/6dde8685ed3f19837767bce7a13a5491e3d0e0bf x_refsource_MISC

Affected products

CairoSVG

==< 2.9.0

Matching in nixpkgs

pkgs.cairosvg

SVG converter based on Cairo

nixos-unstable 2.8.2
- nixpkgs-unstable 2.8.2
- nixos-unstable-small 2.8.2
nixos-25.11 2.8.2
- nixos-25.11-small 2.8.2
- nixpkgs-25.11-darwin 2.8.2

pkgs.python312Packages.cairosvg

SVG converter based on Cairo

nixos-25.11 2.8.2
- nixos-25.11-small 2.8.2
- nixpkgs-25.11-darwin 2.8.2

pkgs.python313Packages.cairosvg

SVG converter based on Cairo

nixos-unstable 2.8.2
- nixpkgs-unstable 2.8.2
- nixos-unstable-small 2.8.2
nixos-25.11 2.8.2
- nixos-25.11-small 2.8.2
- nixpkgs-25.11-darwin 2.8.2

pkgs.python314Packages.cairosvg

SVG converter based on Cairo

nixos-unstable 2.8.2
- nixpkgs-unstable 2.8.2
- nixos-unstable-small 2.8.2

Package maintainers

@sarahec Sarah Clark <seclark@nextquestion.net>

Upstream advisory: https://github.com/Kozea/CairoSVG/security/advisories/GHSA-f38f-5xpm-9r7c
Upstream patch: https://github.com/Kozea/CairoSVG/commit/6dde8685ed3f19837767bce7a13a5491e3d0e0bf

Suggestions search

References

Affected products

Matching in nixpkgs

pkgs.cairosvg

pkgs.python312Packages.cairosvg

pkgs.python313Packages.cairosvg

pkgs.python314Packages.cairosvg

Package maintainers