CVE-2026-31899
HIGHCairoSVG < 2.9.0 - Denial of Service via Recursive <use> Element Amplification
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2026-31899. PoCs published by XiaomingX, SnailSploit.
AI-analyzed exploit summary This repository provides a detailed technical analysis and proof-of-concept for CVE-2026-31899, an exponential DoS vulnerability in CairoSVG caused by uncontrolled recursion in the handling of SVG <use> elements. The analysis includes a breakdown of the vulnerability mechanics, a functional PoC SVG payload, and remediation guidance.
Description
CairoSVG is an SVG converter based on Cairo, a 2D graphics library. Prior to Kozea/CairoSVG has exponential denial of service via recursive <use> element amplification in cairosvg/defs.py. This causes CPU exhaustion from a small input.
Exploits (2)
This repository provides a detailed technical analysis and proof-of-concept for CVE-2026-31899, an exponential DoS vulnerability in CairoSVG caused by uncontrolled recursion in the handling of SVG <use> elements. The analysis includes a breakdown of the vulnerability mechanics, a functional PoC SVG payload, and remediation guidance.
This repository provides a detailed technical analysis and proof-of-concept for CVE-2026-31899, an exponential DoS vulnerability in CairoSVG caused by recursive <use> element amplification. It includes a functional SVG payload and reproduction steps.
References (2)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H