GHSA-f38f-5xpm-9r7c CairoSVG vulnerable to Exponential DoS via recursive <use> element amplification

• PyPI CairoSVG: < 2.9.0 → fixed in 2.9.0

Summary Kozea/CairoSVG (~300K downloads/week) has exponential denial of service via recursive `` element amplification in `cairosvg/defs.py` (line ~335). This causes CPU exhaustion from a small input. Severity High — CVSS 3.1: 7.5 Vector: `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H` Vulnerable Code File: `cairosvg/defs.py` (line ~335), function `use()` The `use()` function recursively processes `` elements without any depth or count limits. With 5 levels of nesting and 10 references each, a 1,411-byte SVG triggers 10^5 = 100,000 render calls. Impact • 1,411-byte SVG payload pins CPU at 100% indefinitely • Memory stays flat at ~43MB — no OOM kill, process never terminates • Any service accepting SVG input (thumbnailing, PDF generation, avatar rendering) is DoS-able • Amplification factor: O(10^N) rendering calls from O(N) input Proof of Concept Save as `poc.svg` and run `timeout 10 cairosvg poc.svg -o test.png`: ```xml ``` Expected: `timeout` kills the process after 10 seconds (it never completes on its own). Alternatively test with Python: ```python import cairosvg, signal signal.alarm(5) # Kill after 5 seconds try: cairosvg.svg2png(bytestring=open("poc.svg").read()) except: print("[!!!] CONFIRMED: CPU exhaustion — process did not complete in 5s") ``` Suggested Fix Add recursion depth counter to `use()` function. Cap at e.g. 10 levels. Also add total element budget to prevent amplification. References • CWE-400 Credit Kai Aizen (SnailSploit) — Adversarial AI & Security Research