Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
fpdf2 expands SVG ` ` references by deep-copying the complete referenced graphics tree. A small SVG can use nested references to make the number of in-memory objects grow exponentially, causing excessive CPU and memory consumption during `FPDF.image()` processing. This was reproduced with an 895-byte SVG on fpdf2 2.8.7. Under a 128 MB process limit, the input kept the process busy for about 14 seconds before raising `MemoryError`. Details The issue is in fpdf2's own SVG reference handling. It does not rely on XML entities, external URLs, local files, or vulnerable behavior in another dependency. When fpdf2 resolves an SVG reference, `SVGObject.build_xref()` passes the referenced object to `GraphicsContext.add_item()`: ```python pdf_group.add_item(self.cross_references[ref]) ```…
Recommended action: Upgrade to 2.8.8 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
`fpdf2` implicitly dereferences image resource references supplied to rendering APIs. If an application passes untrusted HTML, SVG, template data, or image paths into those APIs, `fpdf2` may issue outbound HTTP(S) requests or attempt to open local filesystem paths. This behavior is relevant in applications that render untrusted or user-provided input without sanitizing or restricting embedded resource references. Description In affected versions, `fpdf2` uses a shared internal image-loading mechanism for multiple features. This loader: * fetches `http://` and `https://` URLs over the network * opens other string values as local filesystem paths During document processing, resource references embedded in input content are automatically dereferenced using this mechanism. This behavior is reachable through: * `FPDF.image()` * `FPDF.write_html()` via HTML ` ` * `FPDF.image()` when rendering SVG files containing ` ` or `xlink:href="...">` * template image elements that…
Recommended action: Upgrade to 2.8.8 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.