py-pdf fpdf2 vulnerabilities

Latest py-pdf fpdf2 CVEs

Newest publication first

1. CVE-2026-114610 fpdf2: Exponential SVG '<use>' expansion causes CPU and memory exhaustion in 'FPDF.image()'

   Published 2026-10-22

   Medium·CVSS 6.5 EPSS 0.46%

   fpdf2 is a PDF creation library for Python. From 2.5.0 until 2.8.8, fpdf2's SVGObject.build_xref() passes nested SVG <use> references to GraphicsContext.add_item(), whose default clone=True deep-copy behavior copies the complete referenced graphics tree during FPDF.image() proces...

2. CVE-2026-114609 fpdf2 implicitly loads external URLs and local image paths when rendering attacker-controlled content

   Published 2026-10-22

   Medium·CVSS 5.8 EPSS 0.25%

   fpdf2 is a PDF creation library for Python. Prior to 2.8.8, fpdf2's shared image loader automatically dereferences attacker-controlled HTTP(S) URLs and raw local paths supplied through FPDF.image(), FPDF.write_html() HTML <img src> values, SVG <image href> or xlink:href values, a...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.