{"id":"CVE-2021-21236","aliases":["GHSA-hq37-853p-g5cf","PYSEC-2021-5"],"title":"Regular Expression Denial of Service in CairoSVG","summary":"Regular Expression Denial of Service in CairoSVG","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","vendor":"cairosvg","product":"cairosvg","ecosystem":"pip","affected":["cairosvg < 2.5.1"],"patched":["cairosvg 2.5.1"],"published":"2021-01-06","updated":"2026-09-10","sourceUpdated":"2026-09-10T03:49:14.069813467Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-hq37-853p-g5cf","references":[{"url":"https://github.com/Kozea/CairoSVG/security/advisories/GHSA-hq37-853p-g5cf"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-21236"},{"url":"https://github.com/Kozea/CairoSVG/commit/cfc9175e590531d90384aa88845052de53d94bf3"},{"url":"https://github.com/Kozea/CairoSVG"},{"url":"https://github.com/Kozea/CairoSVG/releases/tag/2.5.1"},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/cairosvg/PYSEC-2021-5.yaml"},{"url":"https://pypi.org/project/CairoSVG"}],"tags":["osv","pip"],"epss":0.01466,"epssPercentile":0.72581,"ingestedAt":"2026-09-12T03:13:01.701Z","slug":"CVE-2021-21236","body":"## Overview\n\n# Doyensec Vulnerability Advisory \n\n* Regular Expression Denial of Service (REDoS) in cairosvg\n* Affected Product: CairoSVG v2.0.0+\n* Vendor: https://github.com/Kozea\n* Severity: Medium\n* Vulnerability Class: Denial of Service\n* Author(s): Ben Caller ([Doyensec](https://doyensec.com))\n\n## Summary\n\nWhen processing SVG files, the python package CairoSVG uses two regular expressions which are vulnerable to Regular Expression Denial of Service (REDoS).\nIf an attacker provides a malicious SVG, it can make cairosvg get stuck processing the file for a very long time.\n\n## Technical description\n\nThe vulnerable regular expressions are\n\nhttps://github.com/Kozea/CairoSVG/blob/9c4a982b9a021280ad90e89707eacc1d114e4ac4/cairosvg/colors.py#L190-L191\n\nThe section between 'rgb(' and the final ')' contains multiple overlapping groups.\n\nSince all three infinitely repeating groups accept spaces, a long string of spaces causes catastrophic backtracking when it is not followed by a closing parenthesis.\n\nThe complexity is cubic, so doubling the length of the malicious string of spaces makes processing take 8 times as long.\n\n## Reproduction steps\n\nCreate a malicious SVG of the form:\n\n    <svg width=\"1\" height=\"1\"><rect fill=\"rgb(                     ;\"/></svg>\n\nwith the following code:\n\n    '<svg width=\"1\" height=\"1\"><rect fill=\"rgb(' + (' ' * 3456) + ';\"/></svg>'\n\nNote that there is no closing parenthesis before the semi-colon.\n\nRun cairosvg e.g.:\n\n    cairosvg cairo-redos.svg -o x.png\n\nand notice that it hangs at 100% CPU. Increasing the number of spaces increases the processing time with cubic complexity.\n\n## Remediation\n\nFix the regexes to avoid overlapping parts. Perhaps remove the [ \\n\\r\\t]* groups from the regex, and use .strip() on the returned capture group.\n\n## Disclosure timeline\n\n- 2020-12-30: Vulnerability disclosed via email to CourtBouillon\n\n## Affected packages\n\n- `cairosvg < 2.5.1`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `cairosvg 2.5.1`","depth":"twilight","depthScore":42,"depthScoreParts":{"impact":41.3,"likelihood":0.3,"exploitation":0,"ransomware":0},"changes":[]}