CVE-2026-31899
Published: 13 March 2026
Summary
CVE-2026-31899 is a high-severity Uncontrolled Recursion (CWE-674) vulnerability in Courtbouillon Cairosvg. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 12.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SC-5 (Denial-of-service Protection) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2026-31899 is an exponential denial-of-service vulnerability in CairoSVG, an SVG-to-PDF/PNG/PostScript converter library based on the Cairo 2D graphics library. The issue stems from recursive amplification of the <use> element in the cairosvg/defs.py module, which allows a small malicious SVG input to trigger excessive CPU consumption and exhaustion. It has been assigned a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) and maps to CWE-674 (Uncontrolled Recursion). The vulnerability affects CairoSVG versions prior to the fix committed by Kozea/CairoSVG.
Attackers can exploit this vulnerability remotely over the network with low complexity and no required privileges or user interaction. By supplying a specially crafted SVG file featuring deeply recursive <use> elements, an unauthenticated attacker can cause the targeted CairoSVG instance to enter an infinite recursion loop, leading to complete CPU exhaustion and denial of service. No confidentiality or integrity impacts are possible, but the high availability impact makes it suitable for disrupting services that process untrusted SVG inputs, such as web applications or document converters.
Mitigation is addressed in the GitHub security advisory (GHSA-f38f-5xpm-9r7c) and the fixing commit (6dde8685ed3f19837767bce7a13a5491e3d0e0bf), which resolve the recursion issue in cairosvg/defs.py. Security practitioners should update to a patched version of CairoSVG and validate or sanitize SVG inputs, particularly in environments handling user-supplied files. The CVE was published on 2026-03-13.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-12091
Vulnerability details
CairoSVG is an SVG converter based on Cairo, a 2D graphics library. Prior to Kozea/CairoSVG has exponential denial of service via recursive <use> element amplification in cairosvg/defs.py. This causes CPU exhaustion from a small input.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability enables remote exploitation of public-facing applications (e.g., web services or converters) that process untrusted SVGs via T1190, directly causing application exhaustion/DoS through crafted recursive input as described in T1499.004.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Remediates the uncontrolled recursion flaw in CairoSVG's defs.py by requiring timely patching to the fixed version.
Validates untrusted SVG inputs to reject or sanitize malicious recursive <use> elements that trigger exponential CPU usage.
Implements denial-of-service protections like resource quotas to limit CPU exhaustion from small malicious SVG inputs.