p PatchFirst

CVE-2021-21236

CVE-2021-21236 · Regular Expression Denial of Service in CairoSVG

This page contains facts from public vulnerability sources. Check the original advisory before updating.

CairoSVG is a Python (pypi) package. CairoSVG is an SVG converter based on Cairo. In CairoSVG before version 2.5.1, there is a regular expression denial of service (REDoS) vulnerability. When processing SVG files, the python package CairoSVG uses two regular expressions which are vulnerable to Regular Expression Denial of Service (REDoS). If an attacker provides a malicious SVG, it can make cairosvg get stuck processing the file for a very long time. This is fixed in version 2.5.1. See Referenced GitHub advisory for more information.

CVSS 5.7 · Medium · EPSS 1.4% · Fix available

Published
Updated

Stack: system · python

Affected products and versions

  • cairosvg

    Versions
    • < 2.5.1: Affected

    No fix published

  • cairosvg Debian:12

    Affected ranges
    • ECOSYSTEM: < 2.5.0-1.1

    Update to 2.5.0-1.1

  • cairosvg Debian:13

    Affected ranges
    • ECOSYSTEM: < 2.5.0-1.1

    Update to 2.5.0-1.1

  • cairosvg Debian:14

    Affected ranges
    • ECOSYSTEM: < 2.5.0-1.1

    Update to 2.5.0-1.1

  • cairosvg PyPI

    Versions
    • 0.1
    • 0.1.1
    • 0.1.2
    • 0.2
    • 0.3
    • 0.3.1
    • 0.4
    • 0.4.1
    • 0.4.2
    • 0.4.3
    • 0.4.4
    • 0.5
    • 1.0
    • 1.0.1
    • 1.0.10
    • 1.0.11
    • 1.0.12
    • 1.0.13
    • 1.0.14
    • 1.0.15
    • 1.0.16
    • 1.0.17
    • 1.0.18
    • 1.0.19
    • 1.0.2
    • 1.0.20
    • 1.0.21
    • 1.0.22
    • 1.0.3
    • 1.0.4
    • 1.0.5
    • 1.0.6
    • 1.0.7
    • 1.0.8
    • 1.0.9
    • 2.0.0
    • 2.0.0rc1
    • 2.0.0rc2
    • 2.0.0rc3
    • 2.0.0rc4
    • 2.0.0rc5
    • 2.0.0rc6
    • 2.0.1
    • 2.0.2
    • 2.0.3
    • 2.1.0
    • 2.1.1
    • 2.1.2
    • 2.1.3
    • 2.2.0
    • 2.2.1
    • 2.3.0
    • 2.3.1
    • 2.4.0
    • 2.4.1
    • 2.4.2
    • 2.5.0
    Affected ranges
    • ECOSYSTEM: < 2.5.1

    Update to 2.5.1

  • cairosvg PyPI

    Versions
    • 0.1
    • 0.1.1
    • 0.1.2
    • 0.2
    • 0.3
    • 0.3.1
    • 0.4
    • 0.4.1
    • 0.4.2
    • 0.4.3
    • 0.4.4
    • 0.5
    • 1.0
    • 1.0.1
    • 1.0.2
    • 1.0.3
    • 1.0.4
    • 1.0.5
    • 1.0.6
    • 1.0.7
    • 1.0.8
    • 1.0.9
    • 1.0.10
    • 1.0.11
    • 1.0.12
    • 1.0.13
    • 1.0.14
    • 1.0.15
    • 1.0.16
    • 1.0.17
    • 1.0.18
    • 1.0.19
    • 1.0.20
    • 1.0.21
    • 1.0.22
    • 2.0.0rc1
    • 2.0.0rc2
    • 2.0.0rc3
    • 2.0.0rc4
    • 2.0.0rc5
    • 2.0.0rc6
    • 2.0.0
    • 2.0.1
    • 2.0.2
    • 2.0.3
    • 2.1.0
    • 2.1.1
    • 2.1.2
    • 2.1.3
    • 2.2.0
    • 2.2.1
    • 2.3.0
    • 2.3.1
    • 2.4.0
    • 2.4.1
    • 2.4.2
    • 2.5.0
    Affected ranges
    • GIT: < cfc9175e590531d90384aa88845052de53d94bf3
    • ECOSYSTEM: < 2.5.1

    Update to 2.5.1

  • cairosvg Ubuntu:16.04:LTS

    Versions
    • 1.0.16-1
    • 1.0.17-1
    • 1.0.19-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • cairosvg Ubuntu:18.04:LTS

    Versions
    • 1.0.20-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • cairosvg Ubuntu:20.04:LTS

    Versions
    • 2.4.0-2
    • 2.4.2-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • cairosvg Ubuntu:22.04:LTS

    Versions
    • 2.5.0-1.1
    • 2.5.2-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • cairosvg Ubuntu:24.04:LTS

    Versions
    • 2.7.1-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • cairosvg Ubuntu:25.10

    Versions
    • 2.7.1-1
    • 2.7.1-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • cairosvg Ubuntu:26.10

    Versions
    • 2.8.2-1
    • 2.9.0-1
    • 2.9.0-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • cairosvg Ubuntu:26.04:LTS

    Versions
    • 2.7.1-2
    • 2.8.2-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →