fpdf2 vulnerabilities
CVEs whose affected-version data names the fpdf2 package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
2 CVEsRSS
CVE-2026-114610Medium· 6.5fpdf2: Exponential SVG '<use>' expansion causes CPU and memory exhaustion in 'FPDF.image()'
fpdf2 is a PDF creation library for Python. From 2.5.0 until 2.8.8, fpdf2's SVGObject.build_xref() passes nested SVG <use> references to GraphicsContext.add_item(), whose default clone=True deep-copy behavior copies the complete referenc…
▾ Sunlitpy-pdf · fpdf2via CVEORG
CVE-2026-114609Medium· 5.8fpdf2 implicitly loads external URLs and local image paths when rendering attacker-controlled content
fpdf2 is a PDF creation library for Python. Prior to 2.8.8, fpdf2's shared image loader automatically dereferences attacker-controlled HTTP(S) URLs and raw local paths supplied through FPDF.image(), FPDF.write_html() HTML <img src> value…
▾ Sunlitpy-pdf · fpdf2via CVEORG