{"cve":"CVE-2021-21236","nvd":{"published":"2021-01-06T17:15:23.733","modified":"2026-06-17T03:35:05.927","status":"Modified","description":"CairoSVG is a Python (pypi) package. CairoSVG is an SVG converter based on Cairo. In CairoSVG before version 2.5.1, there is a regular expression denial of service (REDoS) vulnerability. When processing SVG files, the python package CairoSVG uses two regular expressions which are vulnerable to Regular Expression Denial of Service (REDoS). If an attacker provides a malicious SVG, it can make cairosvg get stuck processing the file for a very long time. This is fixed in version 2.5.1. See Referenced GitHub advisory for more information.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","score":5.5},"cwes":["CWE-400"],"references":["https://github.com/Kozea/CairoSVG/commit/cfc9175e590531d90384aa88845052de53d94bf3","https://github.com/Kozea/CairoSVG/releases/tag/2.5.1","https://github.com/Kozea/CairoSVG/security/advisories/GHSA-hq37-853p-g5cf","https://pypi.org/project/CairoSVG/","https://github.com/Kozea/CairoSVG/commit/cfc9175e590531d90384aa88845052de53d94bf3"],"products":["courtbouillon:cairosvg"],"source":"nvd","synced_at":"2026-10-19T21:12:09.559580076+00:00"},"epss":{"cve":"CVE-2021-21236","score":0.01368,"percentile":0.71881,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-hq37-853p-g5cf","url":"https://osv.dev/vulnerability/GHSA-hq37-853p-g5cf","summary":"Regular Expression Denial of Service in CairoSVG","modified":"2026-09-10T03:49:14.069813467Z","packages":[{"ecosystem":"PyPI","name":"cairosvg","purl":"pkg:pypi/cairosvg","ranges":["<2.5.1"],"fixed":["2.5.1"]}]},{"id":"PYSEC-2021-5","url":"https://osv.dev/vulnerability/PYSEC-2021-5","summary":"","modified":"2023-11-08T04:04:38.945453Z","packages":[{"ecosystem":"PyPI","name":"cairosvg","purl":"pkg:pypi/cairosvg","ranges":["<2.5.1"],"fixed":["2.5.1"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}