CVE-2026-114610

fpdf2 is a PDF creation library for Python. From 2.5.0 until 2.8.8, fpdf2's SVGObject.build_xref() passes nested SVG <use> references to GraphicsContext.add_item(), whose default clone=True deep-copy behavior copies the complete referenced graphics tree during FPDF.image() processing. Repeating references at each nesting level makes the in-memory object count and processing work grow exponentially, allowing a small user-controlled SVG to consume excessive CPU and memory, raise MemoryError, fail PDF generation jobs, and reduce or exhaust worker capacity. ResourceAccessPolicy does not prevent the issue because the references are inline and require no external resource, XML entity, local file, or permissive network setting. This issue is fixed in version 2.8.8.

• CWE-400
• CWE-770

• https://github.com/py-pdf/fpdf2/commit/d7bd1061205d50da6a541dadfdb9d66beb763f2f
• https://github.com/py-pdf/fpdf2/pull/1889
• https://github.com/py-pdf/fpdf2/releases/tag/2.8.8
• https://github.com/py-pdf/fpdf2/security/advisories/GHSA-wqw6-wpr3-45rh

Published

Oct 22, 2026

Last Modified

Oct 22, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-114605dnspython is a DNS toolkit for Python. Prior to 2.9.0, dns.n…7.5
• CVE-2026-114606draw.io Desktop is the official Electron build of draw.io. P…5.6
• CVE-2026-114607Better Auth is an authentication and authorization library f…9.1
• CVE-2026-114608Pylint is a static code analyser for Python. From 0.15.2 unt…5.4
• CVE-2026-114609fpdf2 is a PDF creation library for Python. Prior to 2.8.8, …5.8
• CVE-2026-11461A vulnerability has been found in NousResearch hermes-agent …6.3
• CVE-2026-114611OCO-Server is a self-hosted endpoint management application …9.1
• CVE-2026-11462A vulnerability was found in Chengdu Everbrite Network Techn…7.3
• CVE-2026-11463A vulnerability was determined in USCiLab Cereal up to 1.3.2…7.3
• CVE-2026-114633WWBN AVideo before 29.4.0 contains an incorrect authorizatio…6.5
• CVE-2026-114634WWBN AVideo before 29.4.0 contains a blind server-side reque…4.3
• CVE-2026-114635Traefik before v2.11.58 and v3.7.14 contains an authenticati…8.7