f pdf2 is a Python PDF creation library that supports embedding SVG images. Between versions 2.5.0 and 2.8.8, the library's SVGObject.build_xref() function forwards nested <use> references to GraphicsContext.add_item() with clone=true, causing a deep‑copy of an entire referenced graphics tree every time the image is rendered by FPDF.image(). Each level of nesting amplifies the amount of data duplicated in memory, allowing an attacker with control over the SVG to trigger exponential growth in CPU effort and RAM usage. The result is a MemoryError or a dramatic slowdown, which can break PDF generation jobs and deplete worker capacity.

Affected product is the fpdf2 library, distributed from the py‑pdf organization, in versions 2.5.0 through 2.8.8 inclusive. The issue is fixed in release 2.8.8, so any deployment using an earlier version is vulnerable.

With no EPSS score reported and the vulnerability not listed in the CISA KEV catalog, the exploitation probability is unclear, yet the exploit path does not require external resources; any party able to supply a malicious SVG to an application that uses FPDF.image() can provoke the denial of service. The CVSS score of 6.5 indicates moderate severity, meaning that while the vulnerability does not give direct code execution, the impact on availability can be significant in shared services or batch jobs. The lack of external dependencies makes the attack an easy local or remote vector if the application exposes SVG uploading functionality.