CVE-2026-114610

Medium

Description

fpdf2 is a PDF creation library for Python. From 2.5.0 until 2.8.8, fpdf2's SVGObject.build_xref() passes nested SVG <use> references to GraphicsContext.add_item(), whose default clone=True deep-copy behavior copies the complete referenced graphics tree during FPDF.image() processing. Repeating references at each nesting level makes the in-memory object count and processing work grow exponentially, allowing a small user-controlled SVG to consume excessive CPU and memory, raise MemoryError, fail PDF generation jobs, and reduce or exhaust worker capacity. ResourceAccessPolicy does not prevent the issue because the references are inline and require no external resource, XML entity, local file, or permissive network setting. This issue is fixed in version 2.8.8.

SeverityMedium

CVSS6.5

Exploit probability—

ProductFpdf2

PublishedOct 22, 2026

First seenOct 22, 2026

Weakness typeCWE-400Uncontrolled resource consumption CWE-770Allocation of resources without limits

How to fix

Update

fpdf22.8.8 or later

Affected products

Product	Affected versions	Fixed in
fpdf2PyPI	2.5.0 ≤ v < 2.8.8	2.8.8

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.