Vulnerability details
CVE-2026-29074
Red Hat Cryostat 4Red Hat OpenShift PipelinesRed Hat 3scale API Management Platform 2Red Hat Ansible Automation Platform 2Red Hat Data Grid 8Red Hat Enterprise Linux AI 3
SVGO: DoS through entity expansion in DOCTYPE (Billion Laughs)
CVSS 3.1
7.5High
Official description
SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files. From version 2.1.0 to before version 2.8.1, from version 3.0.0 to before version 3.3.3, and before version 4.0.1, SVGO accepts XML with custom entities, without guards against entity expansion or recursion. This can result in a small XML file (811 bytes) stalling the application and even crashing the Node.js process with JavaScript heap out of memory. This issue has been patched in versions 2.8.1, 3.3.3, and 4.0.1.
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 7.5High | 3.1 | CVEProject cvelistV5 (CNA) (GitHub_M) | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| 7.5High | 3.1 | CVEProject cvelistV5 (CNA) (redhat-SADP) | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| Red Hat | Cryostat 4 | All | CVEProject cvelistV5 (CNA) |
| Red Hat | OpenShift Pipelines | All | CVEProject cvelistV5 (CNA) |
| Red Hat | OpenShift Pipelines | All | CVEProject cvelistV5 (CNA) |
| Red Hat | OpenShift Pipelines | All | CVEProject cvelistV5 (CNA) |
| Red Hat | OpenShift Pipelines | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat 3scale API Management Platform 2 | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat 3scale API Management Platform 2 | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat 3scale API Management Platform 2 | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat 3scale API Management Platform 2 | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat 3scale API Management Platform 2 | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat 3scale API Management Platform 2 | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat 3scale API Management Platform 2 | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat 3scale API Management Platform 2 | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Ansible Automation Platform 2 | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Data Grid 8 | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Enterprise Linux AI (RHEL AI) 3 | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Enterprise Linux AI (RHEL AI) 3 | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Fuse 7 | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat OpenShift Dev Spaces | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat OpenShift distributed tracing 3 | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Single Sign-On 7 | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat build of Apicurio Registry 2 | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Self-service automation portal 2 | All | CVEProject cvelistV5 (CNA) |
| svg | svgo | = 4.0.0 | CVEProject cvelistV5 (CNA) |
| svg | svgo | >= 2.1.0, < 2.8.1 | CVEProject cvelistV5 (CNA) |
| svg | svgo | >= 3.0.0, < 3.3.3 | CVEProject cvelistV5 (CNA) |
References and advisories
29- https://github.com/svg/svgo/security/advisories/GHSA-xpqw-6gx7-v673 x_refsource_CONFIRM
- https://access.redhat.com/security/cve/CVE-2026-29074 vdb-entryx_refsource_REDHAT
- https://bugzilla.redhat.com/show_bug.cgi?id=2445132 issue-trackingx_refsource_REDHAT
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-29074.json x_sadp-csaf-vex
- https://access.redhat.com/errata/RHSA-2026:13512 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:6277 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:7110 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:13553 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:6309 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:13545 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:9742 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:13826 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:5807 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:24977 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:19712 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:21772 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:8483 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:8484 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:8490 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:8491 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:8493 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:11916 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:11856 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:21017 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:6568 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:19375 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:22465 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:48085 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:6926 vendor-advisoryx_refsource_REDHAT
Kolun on Telegram @kolunsec
Exploited CVEs, key news and a daily digest
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.
Details
- Published
- 2026-03-06
- Last updated
- 2026-09-10
- State
- Published
- Assigner (CNA)
- GitHub_M
Exploit prediction (EPSS)
0.7%
Probability of exploitation in 30 days
53.4%
Percentile (among all CVEs)
SSVC assessment (CISA)
- Automatable
- Yes
- Exploitation
- None
- Technical impact
- Partial
Weaknesses (CWE)
- CWE-776Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')