crates.ioPackage

librsvg

2 known vulnerabilities (1 high), with the versions each affects and the releases that fix them.

Version timeline

CVE-2026-96889
Affects 2.56.0 to 2.57.3 (2.57.5 is outside it); 2.58.0-beta.0 to 2.60.2 (2.60.3 is outside it); 2.61.0 to 2.61.4 (2.61.5 is outside it); 2.62.0-beta.0 to 2.62.3 (2.62.4 is outside it); 2.63.0-beta.0 to 2.63.1 (2.63.2 is outside it)
CVE-2015-7558
No published release is affected
No published release is affected

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

CVE-2026-96889High 7.8
Librsvg: use-after-free when xml includes have duplicated entities
Affected: fixed in 2.57.5; from 2.57.90, fixed in 2.60.3; from 2.61.0, fixed in 2.61.5; from 2.61.90, fixed in 2.62.4; from 2.62.90, fixed in 2.63.2; fixed in 2.57.5; from 2.60.0-beta.0, fixed in 2.60.3; from 2.61.0, fixed in 2.61.5; from 2.62.0-beta.0, fixed in 2.62.4; from 2.63.0-beta.0, fixed in 2.63.2.
Fixed in 2.57.5 (released Oct 1, 2026, 8 days after disclosure), 2.60.3 (released Sep 28, 2026, 5 days after disclosure), 2.61.5 (released Sep 25, 2026, 2 days after disclosure) and 2 other versions.
The latest release, 2.63.4, is not affected.
CVE-2015-7558Unrated
librsvg before 2.40.12 allows context-dependent attackers to cause a denial of service (infinite loop, stack consumption, and application…
Affected: fixed in 2.40.12.
Fixed in 2.56.0 (released Jul 21, 2023, 2618 days after disclosure, the advisory names 2.40.12, which was never published).
The latest release, 2.63.4, is not affected.
0% of librsvg downloads in the last 90 days were affected versions (0).