CVE-2026-114610

Name of the Vulnerable Software and Affected Versions fpdf2 versions 2.5.0 through 2.8.7

Description The SVGObject.build xref() function passes nested SVG <use> references to GraphicsContext.add item(). Due to the default clone=True deep-copy behavior during FPDF.image() processing, the complete referenced graphics tree is copied. When references are repeated at each nesting level, the in-memory object count and processing requirements grow exponentially. This allows a small, user-controlled SVG to consume excessive CPU and memory, potentially causing a MemoryError, failing PDF generation jobs, and exhausting worker capacity. This issue persists regardless of the ResourceAccessPolicy because the references are inline and do not require external resources, XML entities, local files, or specific network settings.

Recommendations Update to version 2.8.8.