SUSE-SU-2026:4949-1: Security update for python-CairoSVG

Q: What kind of workload is at risk?

Systems that render attacker-controlled SVG content with python-CairoSVG are at risk of excessive CPU consumption. An SVG path containing many segments can cause quadratic processing behavior.

Q: What does an attacker need to exploit this issue?

The attacker needs to supply an SVG that the affected application renders and that contains a path with many segments. The provided data does not identify any additional access requirements.

Q: Which SUSE environments are listed as affected by this update?

The update lists python-CairoSVG and python311-cairosvg for openSUSE Leap 15.4 and several SUSE Linux Enterprise 15 SP4 and SP5 variants, including SAP Applications and High Performance Computing ESPOS and LTSS offerings.

Published Oct 30, 2026

Updated

This update for python-CairoSVG fixes the following issue:

- CVE-2026-107378: rendering an attacker-controlled SVG with a path containing many segments can lead to quadratic CPU consumption (bsc#1284832).

Other sources

This update for python-CairoSVG fixes the following issue: CVE-2026-107378: rendering an attacker-controlled SVG with a path containing many segments can lead to quadratic CPU consumption (bsc#1284832).

— SUSE

Affected Software

35 affected componentsFixes available

suse/python-cairosvg<2.7.1-150400.9.9.1

2.7.1-150400.9.9.1

suse/python-cairosvg<2.7.1-150400.9.9.1

2.7.1-150400.9.9.1

suse/python-cairosvg<2.7.1-150400.9.9.1

2.7.1-150400.9.9.1

suse/python-cairosvg<2.7.1-150400.9.9.1

2.7.1-150400.9.9.1

suse/python-cairosvg<2.7.1-150400.9.9.1

2.7.1-150400.9.9.1

suse/python-cairosvg<2.7.1-150400.9.9.1

2.7.1-150400.9.9.1

suse/python-cairosvg<2.7.1-150400.9.9.1

2.7.1-150400.9.9.1

suse/python-cairosvg<2.7.1-150400.9.9.1

2.7.1-150400.9.9.1

suse/python-cairosvg<2.7.1-150400.9.9.1

2.7.1-150400.9.9.1

suse/python-cairosvg<2.7.1-150400.9.9.1

2.7.1-150400.9.9.1

suse/python-cairosvg<2.7.1-150400.9.9.1

2.7.1-150400.9.9.1

All of the following

SUSE SUSE Linux Enterprise Server for SAP Applications 15 SP4 (noarch)