Vulnerability feed

Executive summary

The fpdf2 Python PDF library is affected by a flaw in how it renders SVG images, where crafted SVG input with deeply nested or repeated use references could consume excessive CPU and memory. The advisory text provided does not state a severity rating. The fix adds configurable SVG complexity limits that reject oversized SVGs, and the advisory directs users to keep the default limits for untrusted SVG input.

Technical summary

The advisory describes resource exhaustion through SVG <use> reference cycles and excessive nested expansion when rendering SVG images via FPDF.image(). The fix adds an FPDF.svg_limits setting (SVGLimits with max_use_depth and max_resolved_elements, defaults not stated numerically in the text beyond the examples of 64 and 500_000) and raises FPDFSvgLimitExceeded when limits are exceeded. The attack precondition is an application that renders user-supplied SVG files, and the advisory says a small SVG can cause large CPU and memory use. The affected version range and the fixed release version are not stated, and no CVSS score or exploitation status is stated. Detection guidance beyond catching FPDFSvgLimitExceeded and rejecting such input is not stated.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Summarized from github.com/py-pdf/fpdf2/commit/d7bd1061…1dadfdb9d66beb763f2f

Impact if exploited

How it is exploited

Attack vector

Network

Attack complexity

Low

Privileges required

Low

User interaction

None

Scope

Unchanged

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affects

py-pdfpy-pdf fpdf2

Executive summary

This advisory describes changes to fpdf2, a Python PDF creation library, that add a configurable resource access policy controlling whether local files and remote resources can be loaded while rendering HTML, SVG, or images. The advisory text provided does not state a severity rating, and it does not clearly identify a vulnerability being fixed; it reads as a changelog and documentation diff for a new security control. The advisory does not state a specific vendor recommendation beyond keeping the resource access policy restrictive and validating untrusted input.

Technical summary

The changes address the risk that attacker-controlled HTML, SVG, or image paths and URLs could cause fpdf2 to load local files or remote resources, and the documentation notes that SVG/XML parsing uses hardened handling against entity expansion attacks. A new ResourceAccessPolicy flag and a per-call resource_access_policy argument to image() are introduced, with the default set to local files plus public remote HTTP(S) resources and private, loopback, and link-local targets blocked. The advisory does not state a CVE-specific vulnerability class, affected versions, fixed versions, CVSS score, or exploitation status. Workarounds described are setting the policy to NONE or restrictive, validating HTML, SVG, and image paths, and applying network egress and filesystem restrictions. Detection guidance is not stated.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Summarized from github.com/py-pdf/fpdf2/commit/0d27190a…cd881471a14d0622b432

Impact if exploited

How it is exploited

Attack vector

Network

Attack complexity

Low

Privileges required

None

User interaction

None

Scope

Changed

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N

Affects

py-pdffpdf2py-pdf fpdf2fpdf2