CVE-2026-31899

HighPublic PoC

Published: 13 March 2026

Published

13 March 2026

Modified

18 March 2026

KEV Added

—

Patch

—

CVSS Score 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS Score 0.0004 11.2th percentile

Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-31899 is a high-severity Uncontrolled Recursion (CWE-674) vulnerability in Courtbouillon Cairosvg. Its CVSS base score is 7.5 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 11.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190) and 1 other technique.

Threat & Defense Details

Likely Mitigating ControlsAI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

CP-7 Alternate Processing Site

addresses: CWE-674

Supports resumption at alternate site when uncontrolled recursion causes primary site failure or crash.

SC-5 Denial-of-service Protection

addresses: CWE-674

Prevents uncontrolled recursion that exhausts stack or CPU resources.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1499.004 Application or System Exploitation Impact

Adversaries may exploit software vulnerabilities that can cause an application or system to crash and deny availability to users.

attack.mitre.org →

Why these techniques?

The vulnerability enables remote exploitation of public-facing applications (e.g., web services or converters) that process untrusted SVGs via T1190, directly causing application exhaustion/DoS through crafted recursive input as described in T1499.004.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

CairoSVG is an SVG converter based on Cairo, a 2D graphics library. Prior to Kozea/CairoSVG has exponential denial of service via recursive <use> element amplification in cairosvg/defs.py. This causes CPU exhaustion from a small input.

Deeper analysisAI

CVE-2026-31899 is an exponential denial-of-service vulnerability in CairoSVG, an SVG-to-PDF/PNG/PostScript converter library based on the Cairo 2D graphics library. The issue stems from recursive amplification of the <use> element in the cairosvg/defs.py module, which allows a small malicious SVG input to trigger excessive CPU consumption and exhaustion. It has been assigned a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) and maps to CWE-674 (Uncontrolled Recursion). The vulnerability affects CairoSVG versions prior to the fix committed by Kozea/CairoSVG.

Attackers can exploit this vulnerability remotely over the network with low complexity and no required privileges or user interaction. By supplying a specially crafted SVG file featuring deeply recursive <use> elements, an unauthenticated attacker can cause the targeted CairoSVG instance to enter an infinite recursion loop, leading to complete CPU exhaustion and denial of service. No confidentiality or integrity impacts are possible, but the high availability impact makes it suitable for disrupting services that process untrusted SVG inputs, such as web applications or document converters.

Mitigation is addressed in the GitHub security advisory (GHSA-f38f-5xpm-9r7c) and the fixing commit (6dde8685ed3f19837767bce7a13a5491e3d0e0bf), which resolve the recursion issue in cairosvg/defs.py. Security practitioners should update to a patched version of CairoSVG and validate or sanitize SVG inputs, particularly in environments handling user-supplied files. The CVE was published on 2026-03-13.