From 7814c3f8fcdd3e4c777acaf05eb68620d4432d4f Mon Sep 17 00:00:00 2001 From: SnailSploit | Kai Aizen <95986478+SnailSploit@users.noreply.github.com> Date: Sun, 15 Mar 2026 06:47:50 +0200 Subject: [PATCH] Add missing reporter credit to GHSA-f38f-5xpm-9r7c (CVE-2026-31899) The repository security advisory correctly credits @SnailSploit as Reporter, but the CVE record does not include the credits field. --- .../GHSA-f38f-5xpm-9r7c/GHSA-f38f-5xpm-9r7c.json | 15 ++++++++++++--- 1 file changed, 12 insertions(+), 3 deletions(-) diff --git a/advisories/github-reviewed/2026/03/GHSA-f38f-5xpm-9r7c/GHSA-f38f-5xpm-9r7c.json b/advisories/github-reviewed/2026/03/GHSA-f38f-5xpm-9r7c/GHSA-f38f-5xpm-9r7c.json index 08d492f3e14e2..202fbc250f460 100644 --- a/advisories/github-reviewed/2026/03/GHSA-f38f-5xpm-9r7c/GHSA-f38f-5xpm-9r7c.json +++ b/advisories/github-reviewed/2026/03/GHSA-f38f-5xpm-9r7c/GHSA-f38f-5xpm-9r7c.json @@ -7,7 +7,7 @@ "CVE-2026-31899" ], "summary": "CairoSVG vulnerable to Exponential DoS via recursive element amplification", - "details": "## Summary\n\nKozea/CairoSVG has exponential denial of service via recursive `` element amplification in `cairosvg/defs.py` (line ~335). This causes CPU exhaustion from a small input.\n\n## Vulnerable Code\n\nFile: `cairosvg/defs.py` (line ~335), function `use()`\n\nThe `use()` function recursively processes `` elements without any depth or count limits. With 5 levels of nesting and 10 references each, a 1,411-byte SVG triggers 10^5 = 100,000 render calls.\n\n## Impact\n\n- 1,411-byte SVG payload pins CPU at 100% indefinitely\n- Memory stays flat at ~43MB — no OOM kill, process never terminates\n- Any service accepting SVG input (thumbnailing, PDF generation, avatar rendering) is DoS-able\n- Amplification factor: O(10^N) rendering calls from O(N) input\n\n## Proof of Concept\n\nSave as `poc.svg` and run `timeout 10 cairosvg poc.svg -o test.png`:\n\n```xml\n\n\n \n \n \n \n \n \n \n \n\n```\n\nExpected: `timeout` kills the process after 10 seconds (it never completes on its own).\n\nAlternatively test with Python:\n```python\nimport cairosvg, signal\nsignal.alarm(5) # Kill after 5 seconds\ntry:\n cairosvg.svg2png(bytestring=open(\"poc.svg\").read())\nexcept:\n print(\"[!!!] CONFIRMED: CPU exhaustion — process did not complete in 5s\")\n```\n\n## Suggested Fix\n\nAdd recursion depth counter to `use()` function. Cap at e.g. 10 levels. Also add total element budget to prevent amplification.\n\n## References\n\n- [CWE-400](https://cwe.mitre.org/data/definitions/400.html)\n\n## Credit\n\nKai Aizen (SnailSploit) — Adversarial AI & Security Research", + "details": "## Summary\n\nKozea/CairoSVG has exponential denial of service via recursive `` element amplification in `cairosvg/defs.py` (line ~335). This causes CPU exhaustion from a small input.\n\n## Vulnerable Code\n\nFile: `cairosvg/defs.py` (line ~335), function `use()`\n\nThe `use()` function recursively processes `` elements without any depth or count limits. With 5 levels of nesting and 10 references each, a 1,411-byte SVG triggers 10^5 = 100,000 render calls.\n\n## Impact\n\n- 1,411-byte SVG payload pins CPU at 100% indefinitely\n- Memory stays flat at ~43MB \u2014 no OOM kill, process never terminates\n- Any service accepting SVG input (thumbnailing, PDF generation, avatar rendering) is DoS-able\n- Amplification factor: O(10^N) rendering calls from O(N) input\n\n## Proof of Concept\n\nSave as `poc.svg` and run `timeout 10 cairosvg poc.svg -o test.png`:\n\n```xml\n\n\n \n \n \n \n \n \n \n \n\n```\n\nExpected: `timeout` kills the process after 10 seconds (it never completes on its own).\n\nAlternatively test with Python:\n```python\nimport cairosvg, signal\nsignal.alarm(5) # Kill after 5 seconds\ntry:\n cairosvg.svg2png(bytestring=open(\"poc.svg\").read())\nexcept:\n print(\"[!!!] CONFIRMED: CPU exhaustion \u2014 process did not complete in 5s\")\n```\n\n## Suggested Fix\n\nAdd recursion depth counter to `use()` function. Cap at e.g. 10 levels. Also add total element budget to prevent amplification.\n\n## References\n\n- [CWE-400](https://cwe.mitre.org/data/definitions/400.html)\n\n## Credit\n\nKai Aizen (SnailSploit) \u2014 Adversarial AI & Security Research", "severity": [ { "type": "CVSS_V3", @@ -60,5 +60,14 @@ "github_reviewed": true, "github_reviewed_at": "2026-03-13T18:57:31Z", "nvd_published_at": null - } -} \ No newline at end of file + }, + "credits": [ + { + "contact": [ + "https://github.com/SnailSploit" + ], + "name": "Kai Aizen (SnailSploit)", + "type": "FINDER" + } + ] +}