Skip to content
Fencer Vulns
medium 5.7

CVE-2021-21236 json

Regular Expression Denial of Service in CairoSVG

published 2021-01-06 5 y ago modified 2026-09-10 1 mo ago also GHSA-hq37-853p-g5cf , PYSEC-2021-5 , EUVD-2021-0039

cvss
5.7
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
1.4%
EPSS 1.4% chance of exploitation in 30 days, percentile 72%
public exploits
0
none known

Summary

CairoSVG is a Python (pypi) package. CairoSVG is an SVG converter based on Cairo. In CairoSVG before version 2.5.1, there is a regular expression denial of service (REDoS) vulnerability. When processing SVG files, the python package CairoSVG uses two regular expressions which are vulnerable to Regular Expression Denial of Service (REDoS). If an attacker provides a malicious SVG, it can make cairosvg get stuck processing the file for a very long time. This is fixed in version 2.5.1. See Referenced GitHub advisory for more information.

Patch / fix

  • pypi cairosvg 2.5.1
  • courtbouillon cairosvg 2.5.1
  • cairosvg Debian 14, Debian 13, Debian 12 2.5.0-1.1

debian advisories DEBIAN-CVE-2021-21236

  • python-CairoSVG openSUSE Tumbleweed 2.9.0-1.3
  • python-CairoSVG Package Hub 15 SP4, openSUSE Leap 15.4 2.5.2-bp154.2.3.1
  • python-CairoSVG Package Hub 15 SP5, openSUSE Leap 15.5 2.5.2-bp155.3.3.1

opensuse advisories openSUSE-SU-2026:11989-1openSUSE-SU-2023:0272-1openSUSE-SU-2023:0260-1

  • py3-cairosvg Alpine 3.24, Alpine 3.23, Alpine 3.22 +4 more 2.5.1-r0

alpine advisories ALPINE-CVE-2021-21236

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • python-cairosvg Arch Linux 2.5.1-1

arch linux advisories AVG-1412

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2021-21236 updated cvss 5.5

cairosvg: regex vulnerable to a REDoS

  • Red Hat All currently supported Red Hat products
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

1.37% chance of exploitation in the next 30 days, higher than 72% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • github.com https://github.com/Kozea/CairoSVG/security/advisories/GHSA-hq37-853p-g5cf referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 3.1 5.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H
NVD 3.1 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
NVD 2.0 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P
GitHub 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected packages

ecosystem package affected fixed in
pypi cairosvg
<2.5.1
2.5.1

Affected products

  • Kozea CairoSVG

Classification

Weakness
  • CWE-400 Uncontrolled Resource Consumption

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.