Vulnerability · Published Oct 22, 2026 · Assigned by GitHub_M
CVE-2026-114610fpdf2: Exponential SVG '<use>' expansion causes CPU and memory exhaustion in 'FPDF.image()'
Medium 6.5
In plain English
A medium-severity uncontrolled resource consumption in fpdf2 from py-pdf. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 40% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
fpdf2 is a PDF creation library for Python. From 2.5.0 until 2.8.8, fpdf2's SVGObject.build_xref() passes nested SVG <use> references to GraphicsContext.add_item(), whose default clone=True deep-copy behavior copies the complete referenced graphics tree during FPDF.image() processing. Repeating references at each nesting level makes the in-memory object count and processing work grow exponentially, allowing a small user-controlled SVG to consume excessive CPU and memory, raise MemoryError, fail PDF generation jobs, and reduce or exhaust worker capacity. ResourceAccessPolicy does not prevent the issue because the references are inline and require no external resource, XML entity, local file, or permissive network setting. This issue is fixed in version 2.8.8.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:13 | fpdf2 | no fix listed | DEBIAN-CVE-2026-114610 |
| Debian:14 | fpdf2 | 2.8.8-1 | DEBIAN-CVE-2026-114610 |
| PyPI | fpdf2 | 2.8.8 | GHSA-wqw6-wpr3-45rh |
Affected products (as reported)
Weakness: CWE-400, CWE-770 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
References
- https://github.com/py-pdf/fpdf2/security/advisories/GHSA-wqw6-wpr3-45rh x_refsource_CONFIRM
- https://github.com/py-pdf/fpdf2/pull/1889 x_refsource_MISC
- https://github.com/py-pdf/fpdf2/commit/d7bd1061205d50da6a541dadfdb9d66beb763f2f x_refsource_MISC
- https://github.com/py-pdf/fpdf2/releases/tag/2.8.8 x_refsource_MISC