CVE-2024-22641

What it actually does

A crafted SVG input triggers catastrophic backtracking in a regular expression used during SVG parsing, causing the process to consume excessive CPU and potentially hang indefinitely.

Why it matters to the business

Applications that accept or process untrusted SVG files through the library can experience sudden unresponsiveness or resource exhaustion, interrupting document generation workflows and requiring manual intervention to restore service.

How an attack unfolds

An attacker supplies a malicious SVG file containing input engineered to exploit the vulnerable regex; when the library parses the file the regex engine enters repeated backtracking, leading to denial of service without any authentication or special privileges.

How to fix it

Upgrade the library to the first version containing a corrected regular expression; if no patched release is yet published, disable SVG parsing or add strict input validation and resource limits around SVG processing until an update is available.

How to confirm the fix worked

Confirm the installed library version is newer than 6.6.5; test the parser with a known ReDoS SVG payload under controlled conditions and verify that CPU usage remains bounded and processing completes promptly.

Typical attack path

1. Locate an application or service that uses the vulnerable library to render or convert SVG content into PDF.
2. Craft an SVG file containing a string that forces exponential regex backtracking.
3. Submit the SVG through any user-controlled input path (upload, API, or embedded content).
4. Observe sustained high CPU usage and eventual timeout or crash of the processing thread or worker.

How to detect it

Monitor process-level CPU and memory metrics for workers handling PDF generation; inspect application or web-server logs for requests that include SVG payloads immediately preceding resource-exhaustion events.

What your security team should do

• Treat as high-priority availability issue and schedule upgrade within normal change windows.
• Add runtime timeouts and memory/CPU limits to any worker processes that invoke the library on untrusted input.
• Review logs and monitoring for sudden spikes in CPU correlated with SVG processing jobs.
• Consider temporarily disabling SVG-to-PDF conversion paths if the update cannot be applied quickly.