Excessive Resource Consumption in FPDF2 PDF Creation Library
CVE-2026-114610
6.5MEDIUM
What is CVE-2026-114610?
The fpdf2 PDF creation library for Python has a vulnerability that allows user-controlled SVG inputs to create excessive CPU and memory usage. Specifically, from versions 2.5.0 to 2.8.8, the SVGObject.build_xref() function improperly processes nested SVG references, leading to exponential growth in processing resources during PDF generation. This can cause MemoryError conditions, resulting in failed PDF tasks and decreased operational capacity, as the ResourceAccessPolicy does not mitigate the problem due to inline references. Users are encouraged to upgrade to version 2.8.8, which addresses this critical resource management issue.
Affected Version(s)
fpdf2 >= 2.5.0, < 2.8.8