GHSA-249c-7rgc-f52h: 
Python vulnerability analysis and mitigation

Summary

The SVG <path> elliptical-arc parser in svglib.utils.split_arc_values() builds a regex with multiple empty-matchable float groups and two mandatory flag groups, then runs it under re.finditer(). An arc argument that is a long run of digits (containing no 0/1 where a flag is expected) triggers catastrophic backtracking whose cost grows exponentially (~2x per ~4 extra digits). Reachable from any untrusted SVG via svg2rlg / svg2pdf.

Details

svglib/utils.py builds:

float_re = r"(-?\d*\.?\d*(?:[eE][+-]?\d+)?)"            # matches the empty string
a_seq_re = r"[\s,]*".join([float_re]*3 + [flag_re]*2 + [float_re]*2) + r"[\s,]*"
re.finditer(a_seq_re, value)                            # value = a <path> arc argument

Because the float groups can match empty, a digit run with no valid flag char forces the engine to try ~2^(n/4) ways to split the run across the leading float groups, each failing at the mandatory flag group. Path: svg2rlg() -> normalise_svg_path() -> split_arc_values(). Affected: svglib <= 2.3.0. CWE-1333/400/407 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (7.5).

Proof of concept

from svglib.utils import split_arc_values   # reached via svg2rlg -> normalise_svg_path
split_arc_values("A", "9" * 60)             # ~60-digit arc argument: does not return

Verified on PyPI svglib 2.3.0 (cost ~2x per 4 extra digits): 42 digits -> 6.7s, 50 -> ~30s; a ~60-80 digit arc argument (a ~120-150 byte SVG) runs for minutes to hours. The regex runs in C and cannot be interrupted by signal.alarm; a subprocess timeout is required.

Impact

A single small SVG blocks the worker for minutes-to-indefinitely (CPU) -> one-request DoS for any svg2rlg/svg2pdf caller. Same class as CairoSVG ReDoS (CVE-2021-21236).