{"id":"ghsa-ghsa-wqw6-wpr3-45rh","seq":1708826,"kind":"advisory","title":"fpdf2: Exponential SVG '<use>' expansion causes CPU and memory exhaustion in 'FPDF.image()'","url":"https://github.com/advisories/GHSA-wqw6-wpr3-45rh","permalink":"https://vulnpulse.app/items/ghsa-ghsa-wqw6-wpr3-45rh","summary":"影響: pip:fpdf2 >= 2.5.0, < 2.8.8 → 2.8.8\nfpdf2 expands SVG references by deep-copying the complete referenced graphics tree. A small SVG can use nested references to make the number of in-memory objects grow exponentially, causing excessive CPU and memory consumption during FPDF.image() processing. This was reproduced with an 895-byte SVG on fpdf2 2.8.7. Under a 128 MB process limit, the input kept the process busy for about 14 seconds before raising MemoryError. Details The issue is in fpdf2's own SVG reference handling. It does not…","severity":"medium","techs":["python"],"cves":["CVE-2026-114610"],"tags":["GHSA-wqw6-wpr3-45rh","fpdf2"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-27T14:43:19.000Z","fetched_at":"2026-10-27T21:03:52.214Z"}