CVE-2021-21236
In CairoSVG before version 2.5.1, there is a regular expression denial of service (REDoS) vulnerability.
Does this matter?
Lower severity and a low EPSS score (1.37%). Track it; it rarely justifies an emergency change on its own.
Description
CairoSVG is a Python (pypi) package. CairoSVG is an SVG converter based on Cairo. In CairoSVG before version 2.5.1, there is a regular expression denial of service (REDoS) vulnerability. When processing SVG files, the python package CairoSVG uses two regular expressions which are vulnerable to Regular Expression Denial of Service (REDoS). If an attacker provides a malicious SVG, it can make cairosvg get stuck processing the file for a very long time. This is fixed in version 2.5.1. See Referenced GitHub advisory for more information.
- CVSS 3.1
- 5.5 MEDIUMCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
- EPSS
- 1.37% probability · 72th percentile
- Public exploits
- None in Exploit-DB
- CISA KEV
- Not listed
- Weakness
- CWE-400
- Affected
- courtbouillon/cairosvg
- Source
- security-advisories@github.com
EPSS 1.4% since 26 October 2026; no change recorded yet. Points are recorded when the score first appears and whenever it moves by a percentage point or more.
References
- https://github.com/Kozea/CairoSVG/commit/cfc9175e590531d90384aa88845052de53d94bf3Patch, Third Party Advisory
- https://github.com/Kozea/CairoSVG/releases/tag/2.5.1Release Notes, Third Party Advisory
- https://github.com/Kozea/CairoSVG/security/advisories/GHSA-hq37-853p-g5cfExploit, Third Party Advisory
- https://pypi.org/project/CairoSVG/Product, Third Party Advisory
- https://github.com/Kozea/CairoSVG/commit/cfc9175e590531d90384aa88845052de53d94bf3Patch, Third Party Advisory
- https://github.com/Kozea/CairoSVG/releases/tag/2.5.1Release Notes, Third Party Advisory
- https://github.com/Kozea/CairoSVG/security/advisories/GHSA-hq37-853p-g5cfExploit, Third Party Advisory
- https://pypi.org/project/CairoSVG/Product, Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.