rustsec-2026-0200
Vulnerability from osv_rustsec
fulgur converts untrusted HTML/CSS into PDF, commonly on a server that
processes input supplied by many tenants. In versions prior to 0.19.0, a
body-direct child whose CSS-resolved height greatly exceeds the page height was
sliced into one fragment per page with no upper bound.
The height is taken directly from attacker-controlled HTML/CSS (height, vh
units), so a few bytes such as <div style="height:99999999px"></div> forced on
the order of 125,000 page fragments. The pagination code then allocates
vec![Vec::new(); page_count] and runs a per-page render loop, resulting in CPU
and memory exhaustion. A non-finite height (one that resolves to +inf)
additionally made the slicing loop's remaining -= last_slice_h decrement never
terminate, causing an infinite loop.
An attacker able to submit HTML/CSS to a fulgur-based conversion service can trigger this with a trivially small payload, denying service to the host and any co-tenants.
Fixed in 0.19.0: a MAX_PAGES cap bounds the slice loop — halting it even for a
+inf height — and non-finite layout heights are sanitized so they can no
longer drive the loop.
Attack Vector rationale
fulgur performs no network I/O of its own; it renders HTML/CSS handed to it by
the embedding application. This advisory scores the crate independent of any
specific adopting program, so per the CVSS v3.1 User Guide §3.7 the Attack
Vector is assessed as Network for the reasonable worst-case deployment — a
network-facing service that renders untrusted HTML without user interaction. A
concrete system that receives the HTML in one component and passes it to fulgur
in a separate component may assess a lower environmental Attack Vector (Local,
per §3.10).
| URL | Type | |
|---|---|---|
{
"affected": [
{
"database_specific": {
"categories": [
"denial-of-service"
],
"cvss": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"informational": null
},
"ecosystem_specific": {
"affected_functions": null,
"affects": {
"arch": [],
"functions": [],
"os": []
}
},
"package": {
"ecosystem": "crates.io",
"name": "fulgur",
"purl": "pkg:cargo/fulgur"
},
"ranges": [
{
"events": [
{
"introduced": "0.0.0-0"
},
{
"fixed": "0.19.0"
}
],
"type": "SEMVER"
}
],
"versions": []
}
],
"aliases": [
"GHSA-j5cx-ph8g-95v3"
],
"database_specific": {
"license": "CC0-1.0"
},
"details": "`fulgur` converts untrusted HTML/CSS into PDF, commonly on a server that\nprocesses input supplied by many tenants. In versions prior to 0.19.0, a\nbody-direct child whose CSS-resolved height greatly exceeds the page height was\nsliced into one fragment per page with no upper bound.\n\nThe height is taken directly from attacker-controlled HTML/CSS (`height`, `vh`\nunits), so a few bytes such as `\u003cdiv style=\"height:99999999px\"\u003e\u003c/div\u003e` forced on\nthe order of 125,000 page fragments. The pagination code then allocates\n`vec![Vec::new(); page_count]` and runs a per-page render loop, resulting in CPU\nand memory exhaustion. A non-finite height (one that resolves to `+inf`)\nadditionally made the slicing loop\u0027s `remaining -= last_slice_h` decrement never\nterminate, causing an infinite loop.\n\nAn attacker able to submit HTML/CSS to a fulgur-based conversion service can\ntrigger this with a trivially small payload, denying service to the host and any\nco-tenants.\n\nFixed in 0.19.0: a `MAX_PAGES` cap bounds the slice loop \u2014 halting it even for a\n`+inf` height \u2014 and non-finite layout heights are sanitized so they can no\nlonger drive the loop.\n\n## Attack Vector rationale\n\n`fulgur` performs no network I/O of its own; it renders HTML/CSS handed to it by\nthe embedding application. This advisory scores the crate independent of any\nspecific adopting program, so per the CVSS v3.1 User Guide \u00a73.7 the Attack\nVector is assessed as Network for the reasonable worst-case deployment \u2014 a\nnetwork-facing service that renders untrusted HTML without user interaction. A\nconcrete system that receives the HTML in one component and passes it to fulgur\nin a separate component may assess a lower environmental Attack Vector (Local,\nper \u00a73.10).",
"id": "RUSTSEC-2026-0200",
"modified": "2026-07-04T19:39:58Z",
"published": "2026-07-05T12:00:00Z",
"references": [
{
"type": "PACKAGE",
"url": "https://crates.io/crates/fulgur"
},
{
"type": "ADVISORY",
"url": "https://rustsec.org/advisories/RUSTSEC-2026-0200.html"
},
{
"type": "ADVISORY",
"url": "https://github.com/fulgur-rs/fulgur/security/advisories/GHSA-j5cx-ph8g-95v3"
}
],
"related": [],
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "Unbounded page slicing from attacker-controlled CSS height causes denial of service"
}
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.