Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HSummary
CVE-2026-31899 is a high-severity Uncontrolled Recursion (CWE-674) vulnerability in Courtbouillon Cairosvg. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Endpoint Denial of Service (T1499); ranked at the 40th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified map to SI-10 (Information Input Validation) and SC-5 (Denial-of-service Protection) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2026-31899 is an exponential denial-of-service vulnerability in CairoSVG, an SVG-to-PDF/PNG/PostScript converter library based on the Cairo 2D graphics library. The issue stems from recursive amplification of the <use> element in the cairosvg/defs.py module, which allows a small malicious SVG input to trigger excessive CPU consumption and exhaustion. It has been assigned a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) and maps to CWE-674 (Uncontrolled Recursion). The vulnerability affects CairoSVG versions prior to the fix committed by Kozea/CairoSVG.
Attackers can exploit this vulnerability remotely over the network with low complexity and no required privileges or user interaction. By supplying a specially crafted SVG file featuring deeply recursive <use> elements, an unauthenticated attacker can cause the targeted CairoSVG instance to enter an infinite recursion loop, leading to complete CPU exhaustion and denial of service. No confidentiality or integrity impacts are possible, but the high availability impact makes it suitable for disrupting services that process untrusted SVG inputs, such as web applications or document converters.
Mitigation is addressed in the GitHub security advisory (GHSA-f38f-5xpm-9r7c) and the fixing commit (6dde8685ed3f19837767bce7a13a5491e3d0e0bf), which resolve the recursion issue in cairosvg/defs.py. Security practitioners should update to a patched version of CairoSVG and validate or sanitize SVG inputs, particularly in environments handling user-supplied files. The CVE was published on 2026-03-13.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-12091
Vulnerability Data
CairoSVG is an SVG converter based on Cairo, a 2D graphics library. Prior to Kozea/CairoSVG has exponential denial of service via recursive <use> element amplification in cairosvg/defs.py. This causes CPU exhaustion from a small input.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Input validation can reject or constrain data that would otherwise drive unbounded recursive calls.
DoS protection mechanisms limit the resource-exhaustion impact of uncontrolled recursion without eliminating the flaw.
System monitoring can observe anomalous resource consumption that signals runaway recursion after it begins.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly prevent coding errors such as missing recursion limits or termination conditions.
Runtime monitoring of compute resources can detect excessive consumption caused by uncontrolled recursion.
Vulnerability identification processes can discover and record uncontrolled recursion flaws before deployment.
Capacity monitoring and resource provisioning can absorb or limit the impact of runaway recursion.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing in development can detect excessive recursion via static analysis or fuzzing.
Secure development life cycle requires controls that prevent uncontrolled recursion through design and code review.
Application security requirements can mandate recursion limits or stack-depth checks.
Secure system architecture principles include resource-management and input-validation rules that limit recursion.
Secure coding standards directly prohibit or constrain recursive constructs that could exhaust stack or memory.
Capacity management includes monitoring and limits that mitigate resource exhaustion from runaway recursion.