CVE-2021-21236

CairoSVG is a Python (pypi) package. CairoSVG is an SVG converter based on Cairo. In CairoSVG before version 2.5.1, there is a regular expression denial of service (REDoS) vulnerability. When processing SVG files, the python package CairoSVG uses two regular expressions which are vulnerable to Regular Expression Denial of Service (REDoS). If an attacker provides a malicious SVG, it can make cairosvg get stuck processing the file for a very long time. This is fixed in version 2.5.1. See Referenced GitHub advisory for more information.

• CWE-400

• https://github.com/Kozea/CairoSVG/commit/cfc9175e590531d90384aa88845052de53d94bf3Patch, Third Party Advisory
• https://github.com/Kozea/CairoSVG/releases/tag/2.5.1Release Notes, Third Party Advisory
• https://github.com/Kozea/CairoSVG/security/advisories/GHSA-hq37-853p-g5cfExploit, Third Party Advisory
• https://pypi.org/project/CairoSVG/Product, Third Party Advisory
• https://github.com/Kozea/CairoSVG/commit/cfc9175e590531d90384aa88845052de53d94bf3Patch, Third Party Advisory
• https://github.com/Kozea/CairoSVG/releases/tag/2.5.1Release Notes, Third Party Advisory
• https://github.com/Kozea/CairoSVG/security/advisories/GHSA-hq37-853p-g5cfExploit, Third Party Advisory
• https://pypi.org/project/CairoSVG/Product, Third Party Advisory

Published

Jan 6, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-21230Type confusion in V8 in Google Chrome prior to 90.0.4430.93 …8.8
• CVE-2021-21231Insufficient data validation in V8 in Google Chrome prior to…8.8
• CVE-2021-21232Use after free in Dev Tools in Google Chrome prior to 90.0.4…8.8
• CVE-2021-21233Heap buffer overflow in ANGLE in Google Chrome on Windows pr…8.8
• CVE-2021-21234spring-boot-actuator-logview in a library that adds a simple…7.7
• CVE-2021-21235kamadak-exif is an exif parsing library written in pure Rust…6.5
• CVE-2021-21237Git LFS is a command line extension for managing large files…7.8
• CVE-2021-21238PySAML2 is a pure python implementation of SAML Version 2 St…6.5
• CVE-2021-21239PySAML2 is a pure python implementation of SAML Version 2 St…6.5
• CVE-2021-2124Vulnerability in the Oracle VM VirtualBox product of Oracle …6
• CVE-2021-21240httplib2 is a comprehensive HTTP client library for Python. …7.5
• CVE-2021-21241The Python "Flask-Security-Too" package is used for adding s…7.4