Vulnerability-Lookup

CVE-2026-68537 (GCVE-0-2026-68537)

Vulnerability from cvelistv5 – Published: 2026-09-17 20:18 – Updated: 2026-09-17 20:23

Title

Fulgur: Unbounded page slicing from attacker-controlled CSS height causes denial of service

Summary

`fulgur` converts untrusted HTML/CSS into PDF, commonly on a server that processes input supplied by many tenants. In versions prior to 0.19.0, a body-direct child whose CSS-resolved height greatly exceeds the page height was sliced into one fragment per page with no upper bound. This is fixed in version 0.19.0. A `MAX_PAGES` cap bounds the slice loop — halting it even for a `+inf` height — and non-finite layout heights are sanitized so they can no longer drive the loop. As a workaround, validate or constrain untrusted CSS (in particular `height` / `vh` on body-level elements) before passing HTML to fulgur.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-17 20:23 UTC

CWE

CWE-400 - Uncontrolled Resource Consumption
CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

Assigner

GitHub_M mitre root

References

3 references

URL	Tags
https://github.com/fulgur-rs/fulgur/security/advi…	x_refsource_CONFIRM
https://github.com/fulgur-rs/fulgur/pull/501	x_refsource_MISC
https://rustsec.org/advisories/RUSTSEC-2026-0200.html	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version	CPE status
fulgur-rs	fulgur	Affected: < 0.19.0	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-68537",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-17T20:23:00.998569Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-17T20:23:12.488Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "fulgur",
          "vendor": "fulgur-rs",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.19.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "`fulgur` converts untrusted HTML/CSS into PDF, commonly on a server that processes input supplied by many tenants. In versions prior to 0.19.0, a body-direct child whose CSS-resolved height greatly exceeds the page height was sliced into one fragment per page with no upper bound. This is fixed in version 0.19.0. A `MAX_PAGES` cap bounds the slice loop \u2014 halting it even for a `+inf` height \u2014 and non-finite layout heights are sanitized so they can no longer drive the loop. As a workaround, validate or constrain untrusted CSS (in particular `height` / `vh` on body-level elements) before passing HTML to fulgur."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-400",
              "description": "CWE-400: Uncontrolled Resource Consumption",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-835",
              "description": "CWE-835: Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-17T20:18:59.957Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/fulgur-rs/fulgur/security/advisories/GHSA-4rf6-qx84-q9fv",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/fulgur-rs/fulgur/security/advisories/GHSA-4rf6-qx84-q9fv"
        },
        {
          "name": "https://github.com/fulgur-rs/fulgur/pull/501",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/fulgur-rs/fulgur/pull/501"
        },
        {
          "name": "https://rustsec.org/advisories/RUSTSEC-2026-0200.html",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://rustsec.org/advisories/RUSTSEC-2026-0200.html"
        }
      ],
      "source": {
        "advisory": "GHSA-4rf6-qx84-q9fv",
        "discovery": "UNKNOWN"
      },
      "title": "Fulgur: Unbounded page slicing from attacker-controlled CSS height causes denial of service"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-68537",
    "datePublished": "2026-09-17T20:18:59.957Z",
    "dateReserved": "2026-07-30T19:56:44.100Z",
    "dateUpdated": "2026-09-17T20:23:12.488Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-68537",
      "date": "2026-09-18",
      "epss": "0.00339",
      "percentile": "0.27422"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "fulgur",
                "vendor": "fulgur-rs",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003c 0.19.0"
                  }
                ]
              }
            ],
            "source": "security-advisories@github.com"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "`fulgur` converts untrusted HTML/CSS into PDF, commonly on a server that processes input supplied by many tenants. In versions prior to 0.19.0, a body-direct child whose CSS-resolved height greatly exceeds the page height was sliced into one fragment per page with no upper bound. This is fixed in version 0.19.0. A `MAX_PAGES` cap bounds the slice loop \u2014 halting it even for a `+inf` height \u2014 and non-finite layout heights are sanitized so they can no longer drive the loop. As a workaround, validate or constrain untrusted CSS (in particular `height` / `vh` on body-level elements) before passing HTML to fulgur."
          }
        ],
        "id": "CVE-2026-68537",
        "lastModified": "2026-09-17T21:17:19.870",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 7.5,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 3.6,
              "source": "security-advisories@github.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-68537",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "yes"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-17T20:23:00.998569Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-09-17T21:17:19.870",
        "references": [
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/fulgur-rs/fulgur/pull/501"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/fulgur-rs/fulgur/security/advisories/GHSA-4rf6-qx84-q9fv"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://rustsec.org/advisories/RUSTSEC-2026-0200.html"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Received",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-400"
              },
              {
                "lang": "en",
                "value": "CWE-835"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Primary"
          }
        ]
      }
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-68537",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "yes"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-09-17T20:23:00.998569Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-09-17T20:23:07.332Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "fulgur",
              "vendor": "fulgur-rs",
              "versions": [
                {
                  "status": "affected",
                  "version": "\u003c 0.19.0"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "`fulgur` converts untrusted HTML/CSS into PDF, commonly on a server that processes input supplied by many tenants. In versions prior to 0.19.0, a body-direct child whose CSS-resolved height greatly exceeds the page height was sliced into one fragment per page with no upper bound. This is fixed in version 0.19.0. A `MAX_PAGES` cap bounds the slice loop \u2014 halting it even for a `+inf` height \u2014 and non-finite layout heights are sanitized so they can no longer drive the loop. As a workaround, validate or constrain untrusted CSS (in particular `height` / `vh` on body-level elements) before passing HTML to fulgur."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 7.5,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-400",
                  "description": "CWE-400: Uncontrolled Resource Consumption",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            },
            {
              "descriptions": [
                {
                  "cweId": "CWE-835",
                  "description": "CWE-835: Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-09-17T20:18:59.957Z",
            "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
            "shortName": "GitHub_M"
          },
          "references": [
            {
              "name": "https://github.com/fulgur-rs/fulgur/security/advisories/GHSA-4rf6-qx84-q9fv",
              "tags": [
                "x_refsource_CONFIRM"
              ],
              "url": "https://github.com/fulgur-rs/fulgur/security/advisories/GHSA-4rf6-qx84-q9fv"
            },
            {
              "name": "https://github.com/fulgur-rs/fulgur/pull/501",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/fulgur-rs/fulgur/pull/501"
            },
            {
              "name": "https://rustsec.org/advisories/RUSTSEC-2026-0200.html",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://rustsec.org/advisories/RUSTSEC-2026-0200.html"
            }
          ],
          "source": {
            "advisory": "GHSA-4rf6-qx84-q9fv",
            "discovery": "UNKNOWN"
          },
          "title": "Fulgur: Unbounded page slicing from attacker-controlled CSS height causes denial of service"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "assignerShortName": "GitHub_M",
        "cveId": "CVE-2026-68537",
        "datePublished": "2026-09-17T20:18:59.957Z",
        "dateReserved": "2026-07-30T19:56:44.100Z",
        "dateUpdated": "2026-09-17T20:23:12.488Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-68537

Vulnerability from fkie_nvd - Published: 2026-09-17 21:17 - Updated: 2026-09-17 21:17

Severity

7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/fulgur-rs/fulgur/pull/501
	security-advisories@github.com	https://github.com/fulgur-rs/fulgur/security/advisories/GHSA-4rf6-qx84-q9fv
	security-advisories@github.com	https://rustsec.org/advisories/RUSTSEC-2026-0200.html

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "fulgur",
          "vendor": "fulgur-rs",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.19.0"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "`fulgur` converts untrusted HTML/CSS into PDF, commonly on a server that processes input supplied by many tenants. In versions prior to 0.19.0, a body-direct child whose CSS-resolved height greatly exceeds the page height was sliced into one fragment per page with no upper bound. This is fixed in version 0.19.0. A `MAX_PAGES` cap bounds the slice loop \u2014 halting it even for a `+inf` height \u2014 and non-finite layout heights are sanitized so they can no longer drive the loop. As a workaround, validate or constrain untrusted CSS (in particular `height` / `vh` on body-level elements) before passing HTML to fulgur."
    }
  ],
  "id": "CVE-2026-68537",
  "lastModified": "2026-09-17T21:17:19.870",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-68537",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-09-17T20:23:00.998569Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-09-17T21:17:19.870",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/fulgur-rs/fulgur/pull/501"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/fulgur-rs/fulgur/security/advisories/GHSA-4rf6-qx84-q9fv"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://rustsec.org/advisories/RUSTSEC-2026-0200.html"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Received",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-400"
        },
        {
          "lang": "en",
          "value": "CWE-835"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Primary"
    }
  ]
}

GHSA-4RF6-QX84-Q9FV

Vulnerability from github – Published: 2026-09-17 18:49 – Updated: 2026-09-17 18:49

Summary

Fulgur: Non-painting replaced elements amplify to thousands of blank PDF pages (denial of service)

Details

fulgur converts untrusted HTML/CSS into PDF, commonly on a server that processes input supplied by many tenants. In versions prior to 0.26.0, a childless box that resolves to a pathologically tall height was amplified into thousands of blank PDF pages, even when it produces no visible output.

The childless-collapse defense that would normally collapse such a box was gated by a tag-only "replaced content" check, so any non-painting replaced element bypassed it, including:

an unresolved src (the common offline-first case),
a visibility:hidden image,
an undecodable image format, and
an empty <svg>.

A trailing-sibling variant of the same gap was also open. A few bytes of HTML therefore amplified into roughly MAX_PAGES (10,000) blank pages; the renderer allocates and runs a per-page loop over them, producing CPU and memory exhaustion. An attacker able to submit HTML to a fulgur-based conversion service can trigger this with a trivially small payload, denying service to the host and any co-tenants.

Patches

Fixed in 0.26.0 (PR #575). The tag-only gate was removed so that any pathologically tall childless box collapses regardless of whether it is a replaced element, closing the missing-src, visibility:hidden, undecodable-format, and empty-<svg> vectors at once, along with the trailing-sibling variant.

Workarounds

Upgrade to 0.26.0 or later. If upgrading is not immediately possible, validate or constrain untrusted CSS (in particular very large height / vh on elements) before passing HTML to fulgur.

Versions prior to 0.19.0 additionally lacked any page-count cap, allowing an unbounded (rather than 10,000-page) variant of this amplification and a non-terminating loop on non-finite heights. That earlier variant is tracked separately as GHSA-j5cx-ph8g-95v3.

Attack Vector rationale

fulgur performs no network I/O of its own; it renders HTML/CSS handed to it by the embedding application. This advisory scores the crate independent of any specific adopting program, so per the CVSS v3.1 User Guide §3.7 (scoring library vulnerabilities related to incoming data) the Attack Vector is assessed as Network for the reasonable worst-case deployment — a network-facing service that renders untrusted, attacker-supplied HTML without user interaction. A concrete system that receives the HTML in one component and passes it to fulgur in a separate component may assess a lower environmental Attack Vector (Local, per §3.10).

References

Fix: https://github.com/fulgur-rs/fulgur/pull/575

Severity

7.5 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "crates.io",
        "name": "fulgur"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.26.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-68537"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-400"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-09-17T18:49:15Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "`fulgur` converts untrusted HTML/CSS into PDF, commonly on a server that\nprocesses input supplied by many tenants. In versions prior to 0.26.0, a\nchildless box that resolves to a pathologically tall height was amplified into\nthousands of blank PDF pages, even when it produces no visible output.\n\nThe childless-collapse defense that would normally collapse such a box was gated\nby a tag-only \"replaced content\" check, so any **non-painting replaced element**\nbypassed it, including:\n\n- an unresolved `src` (the common offline-first case),\n- a `visibility:hidden` image,\n- an undecodable image format, and\n- an empty `\u003csvg\u003e`.\n\nA trailing-sibling variant of the same gap was also open. A few bytes of HTML\ntherefore amplified into roughly `MAX_PAGES` (10,000) blank pages; the renderer\nallocates and runs a per-page loop over them, producing CPU and memory\nexhaustion. An attacker able to submit HTML to a fulgur-based conversion service\ncan trigger this with a trivially small payload, denying service to the host and\nany co-tenants.\n\n## Patches\n\nFixed in **0.26.0** (PR #575). The tag-only gate was removed so that any\npathologically tall childless box collapses regardless of whether it is a\nreplaced element, closing the missing-`src`, `visibility:hidden`,\nundecodable-format, and empty-`\u003csvg\u003e` vectors at once, along with the\ntrailing-sibling variant.\n\n## Workarounds\n\nUpgrade to 0.26.0 or later. If upgrading is not immediately possible, validate\nor constrain untrusted CSS (in particular very large `height` / `vh` on\nelements) before passing HTML to fulgur.\n\n## Related\n\nVersions prior to 0.19.0 additionally lacked any page-count cap, allowing an\nunbounded (rather than 10,000-page) variant of this amplification and a\nnon-terminating loop on non-finite heights. That earlier variant is tracked\nseparately as GHSA-j5cx-ph8g-95v3.\n\n## Attack Vector rationale\n\n`fulgur` performs no network I/O of its own; it renders HTML/CSS handed to it by\nthe embedding application. This advisory scores the crate independent of any\nspecific adopting program, so per the CVSS v3.1 User Guide \u00a73.7 (scoring library\nvulnerabilities related to incoming data) the Attack Vector is assessed as\n**Network** for the reasonable worst-case deployment \u2014 a network-facing service\nthat renders untrusted, attacker-supplied HTML without user interaction. A\nconcrete system that receives the HTML in one component and passes it to fulgur\nin a separate component may assess a lower environmental Attack Vector (Local,\nper \u00a73.10).\n\n## References\n\n- Fix: https://github.com/fulgur-rs/fulgur/pull/575",
  "id": "GHSA-4rf6-qx84-q9fv",
  "modified": "2026-09-17T18:49:15Z",
  "published": "2026-09-17T18:49:15Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/fulgur-rs/fulgur/security/advisories/GHSA-4rf6-qx84-q9fv"
    },
    {
      "type": "WEB",
      "url": "https://github.com/fulgur-rs/fulgur/pull/575"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/fulgur-rs/fulgur"
    },
    {
      "type": "WEB",
      "url": "https://rustsec.org/advisories/RUSTSEC-2026-0201.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Fulgur: Non-painting replaced elements amplify to thousands of blank PDF pages (denial of service)"
}

RUSTSEC-2026-0201 (CVE-2026-68537)

Vulnerability from osv_rustsec – Published: 2026-07-05 12:00 – Updated: 2026-09-18 06:41 – Source website

Summary

Non-painting replaced elements amplify to thousands of blank PDF pages (denial of service)

Details

The childless-collapse defense that would normally collapse such a box was gated by a tag-only "replaced content" check, so any non-painting replaced element bypassed it, including an unresolved src (the common offline-first case), a visibility:hidden image, an undecodable image format, and an empty <svg>. A trailing-sibling variant of the same gap was also open.

A few bytes of HTML therefore amplified into roughly MAX_PAGES (10,000) blank pages; the renderer allocates and runs a per-page loop over them, producing CPU and memory exhaustion. An attacker able to submit HTML to a fulgur-based conversion service can trigger this with a trivially small payload, denying service to the host and any co-tenants.

Fixed in 0.26.0: the tag-only gate was removed so that any pathologically tall childless box collapses regardless of whether it is a replaced element, closing the missing-src, visibility:hidden, undecodable-format, and empty-<svg> vectors along with the trailing-sibling variant.

Versions prior to 0.19.0 additionally lacked any page-count cap, allowing an unbounded (rather than 10,000-page) variant of this amplification; that earlier variant is tracked separately as GHSA-j5cx-ph8g-95v3.

Attack Vector rationale

fulgur performs no network I/O of its own; it renders HTML/CSS handed to it by the embedding application. This advisory scores the crate independent of any specific adopting program, so per the CVSS v3.1 User Guide §3.7 the Attack Vector is assessed as Network for the reasonable worst-case deployment — a network-facing service that renders untrusted HTML without user interaction. A concrete system that receives the HTML in one component and passes it to fulgur in a separate component may assess a lower environmental Attack Vector (Local, per §3.10).

Severity

7.5 (High)


                    
                      CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

URL

Type

	https://crates.io/crates/fulgur	PACKAGE
	https://rustsec.org/advisories/RUSTSEC-2026-0201.html	ADVISORY
	https://github.com/fulgur-rs/fulgur/security/advi…	ADVISORY

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "categories": [
          "denial-of-service"
        ],
        "cvss": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
        "informational": null
      },
      "ecosystem_specific": {
        "affected_functions": null,
        "affects": {
          "arch": [],
          "functions": [],
          "os": []
        }
      },
      "package": {
        "ecosystem": "crates.io",
        "name": "fulgur",
        "purl": "pkg:cargo/fulgur"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.0.0-0"
            },
            {
              "fixed": "0.26.0"
            }
          ],
          "type": "SEMVER"
        }
      ],
      "versions": []
    }
  ],
  "aliases": [
    "CVE-2026-68537",
    "GHSA-4rf6-qx84-q9fv"
  ],
  "database_specific": {
    "license": "CC0-1.0"
  },
  "details": "`fulgur` converts untrusted HTML/CSS into PDF, commonly on a server that\nprocesses input supplied by many tenants. In versions prior to 0.26.0, a\nchildless box that resolves to a pathologically tall height was amplified into\nthousands of blank PDF pages, even when it produces no visible output.\n\nThe childless-collapse defense that would normally collapse such a box was gated\nby a tag-only \"replaced content\" check, so any non-painting replaced element\nbypassed it, including an unresolved `src` (the common offline-first case), a\n`visibility:hidden` image, an undecodable image format, and an empty `\u003csvg\u003e`. A\ntrailing-sibling variant of the same gap was also open.\n\nA few bytes of HTML therefore amplified into roughly `MAX_PAGES` (10,000) blank\npages; the renderer allocates and runs a per-page loop over them, producing CPU\nand memory exhaustion. An attacker able to submit HTML to a fulgur-based\nconversion service can trigger this with a trivially small payload, denying\nservice to the host and any co-tenants.\n\nFixed in 0.26.0: the tag-only gate was removed so that any pathologically tall\nchildless box collapses regardless of whether it is a replaced element, closing\nthe missing-`src`, `visibility:hidden`, undecodable-format, and empty-`\u003csvg\u003e`\nvectors along with the trailing-sibling variant.\n\nVersions prior to 0.19.0 additionally lacked any page-count cap, allowing an\nunbounded (rather than 10,000-page) variant of this amplification; that earlier\nvariant is tracked separately as GHSA-j5cx-ph8g-95v3.\n\n## Attack Vector rationale\n\n`fulgur` performs no network I/O of its own; it renders HTML/CSS handed to it by\nthe embedding application. This advisory scores the crate independent of any\nspecific adopting program, so per the CVSS v3.1 User Guide \u00a73.7 the Attack\nVector is assessed as Network for the reasonable worst-case deployment \u2014 a\nnetwork-facing service that renders untrusted HTML without user interaction. A\nconcrete system that receives the HTML in one component and passes it to fulgur\nin a separate component may assess a lower environmental Attack Vector (Local,\nper \u00a73.10).",
  "id": "RUSTSEC-2026-0201",
  "modified": "2026-09-18T06:41:06Z",
  "published": "2026-07-05T12:00:00Z",
  "references": [
    {
      "type": "PACKAGE",
      "url": "https://crates.io/crates/fulgur"
    },
    {
      "type": "ADVISORY",
      "url": "https://rustsec.org/advisories/RUSTSEC-2026-0201.html"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/fulgur-rs/fulgur/security/advisories/GHSA-4rf6-qx84-q9fv"
    }
  ],
  "related": [],
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Non-painting replaced elements amplify to thousands of blank PDF pages (denial of service)"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-68537 (GCVE-0-2026-68537)

FKIE_CVE-2026-68537

GHSA-4RF6-QX84-Q9FV

Patches

Workarounds

Related

Attack Vector rationale

References

RUSTSEC-2026-0201 (CVE-2026-68537)

Attack Vector rationale

Tags

Sightings

Nomenclature

Related by attack behaviour