CVE-2026-114610: CWE-400: Uncontrolled Resource Consumption in py-pdf fpdf2
Description
A resource exhaustion vulnerability exists in the py-pdf fpdf2 library versions 2.5.0 through 2.8.7. The issue arises from nested SVG <use> references that cause exponential growth in memory and CPU usage during PDF generation, potentially leading to MemoryError and job failures. This vulnerability is fixed in version 2.8.8.
CVSS v3.1
Score 6.5medium
Affected software
py-pdf
fpdf2
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
In py-pdf's fpdf2 library, versions 2.5.0 up to but not including 2.8.8, the SVGObject.build_xref() method passes nested SVG <use> references to GraphicsContext.add_item(), which by default deep-copies the entire referenced graphics tree during FPDF.image() processing. When SVGs contain repeated nested references, this behavior causes exponential growth in in-memory objects and processing workload. This uncontrolled resource consumption can result in excessive CPU and memory usage, leading to MemoryError exceptions, failed PDF generation jobs, and reduced or exhausted worker capacity. The ResourceAccessPolicy does not mitigate this issue because the references are inline and do not require external resources. The vulnerability is addressed in fpdf2 version 2.8.8.
Potential Impact
This vulnerability can cause denial of service by exhausting CPU and memory resources during PDF generation, resulting in MemoryError exceptions and failed jobs. It can degrade or exhaust worker capacity, impacting availability of services relying on fpdf2 for PDF creation. There is no impact on confidentiality or integrity reported.
Mitigation Recommendations
Upgrade to fpdf2 version 2.8.8 or later, where this uncontrolled resource consumption issue is fixed. No other mitigations are indicated or effective because the problematic SVG references are inline and do not rely on external resources.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-10-21T20:34:25.599Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6ada4bef4d27ba8daa6ca6fe
Added to database: 10/22/2026, 17:46:23 UTC
Last enriched: 10/22/2026, 18:00:47 UTC
Last updated: 10/22/2026, 18:00:47 UTC
Views: 6
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.