{"id":"CVE-2026-68537","aliases":["EUVD-2026-82425","GHSA-4rf6-qx84-q9fv","RUSTSEC-2026-0201"],"status":"published","title":"Fulgur: Unbounded page slicing from attacker-controlled CSS height causes denial of service","description":"`fulgur` converts untrusted HTML/CSS into PDF, commonly on a server that processes input supplied by many tenants. In versions prior to 0.19.0, a body-direct child whose CSS-resolved height greatly exceeds the page height was sliced into one fragment per page with no upper bound. This is fixed in version 0.19.0. A `MAX_PAGES` cap bounds the slice loop — halting it even for a `+inf` height — and non-finite layout heights are sanitized so they can no longer drive the loop. As a workaround, validate or constrain untrusted CSS (in particular `height` / `vh` on body-level elements) before passing HTML to fulgur.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00609,"percentile":0.49512,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-400","CWE-835"],"published":"2026-07-05T12:00:00Z","modified":"2026-10-28T02:30:54Z","fixes":[{"ecosystem":"crates.io","package":"fulgur","fixed_in":["0.26.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"crates.io","package":"fulgur","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.26.0"}]}]},{"source":"osv","ecosystem":"crates.io","package":"fulgur","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.26.0"}]}]},{"source":"osv","ecosystem":"crates.io","package":"fulgur","ranges":[{"type":"SEMVER","events":[{"introduced":"0.0.0-0"},{"fixed":"0.26.0"}]}]}],"products":[{"vendor":"fulgur-rs","product":"fulgur"}],"references":[{"url":"https://github.com/fulgur-rs/fulgur/security/advisories/GHSA-4rf6-qx84-q9fv","tags":["x_refsource_CONFIRM","advisory","web"]},{"url":"https://github.com/fulgur-rs/fulgur/pull/501","tags":["x_refsource_MISC","fix"]},{"url":"https://rustsec.org/advisories/RUSTSEC-2026-0200.html","tags":["x_refsource_MISC","advisory"]},{"url":"https://github.com/fulgur-rs/fulgur/pull/575","tags":["web"]},{"url":"https://rustsec.org/advisories/RUSTSEC-2026-0201.html","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-4rf6-qx84-q9fv"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68537.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68537","tags":["advisory"]},{"url":"https://github.com/fulgur-rs/fulgur","tags":["package"]},{"url":"https://crates.io/crates/fulgur","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-68537","title":"Fulgur: Unbounded page slicing from attacker-controlled CSS height causes denial of service","description":"`fulgur` converts untrusted HTML/CSS into PDF, commonly on a server that processes input supplied by many tenants. In versions prior to 0.19.0, a body-direct child whose CSS-resolved height greatly exceeds the page height was sliced into one fragment per page with no upper bound. This is fixed in version 0.19.0. A `MAX_PAGES` cap bounds the slice loop — halting it even for a `+inf` height — and non-finite layout heights are sanitized so they can no longer drive the loop. As a workaround, validate or constrain untrusted CSS (in particular `height` / `vh` on body-level elements) before passing HTML to fulgur.","status":"published","published":"2026-09-17T20:18:59.957Z","modified":"2026-09-17T20:23:12.488Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-400","CWE-835"],"updated_at":"2026-11-02T13:46:10.323375Z"}],"euvd":[{"id":"EUVD-2026-82425","description":"`fulgur` converts untrusted HTML/CSS into PDF, commonly on a server that processes input supplied by many tenants. In versions prior to 0.19.0, a body-direct child whose CSS-resolved height greatly exceeds the page height was sliced into one fragment per page with no upper bound. This is fixed in version 0.19.0. A `MAX_PAGES` cap bounds the slice loop — halting it even for a `+inf` height — and non-finite layout heights are sanitized so they can no longer drive the loop. As a workaround, validate or constrain untrusted CSS (in particular `height` / `vh` on body-level elements) before passing HTML to fulgur.","status":"published","published":"2026-09-17T20:18:59Z","modified":"2026-09-17T20:23:12Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T17:28:09.684322Z"}],"ghsa":[{"id":"GHSA-4rf6-qx84-q9fv","title":"Fulgur: Non-painting replaced elements amplify to thousands of blank PDF pages (denial of service)","description":"`fulgur` converts untrusted HTML/CSS into PDF, commonly on a server that\nprocesses input supplied by many tenants. In versions prior to 0.26.0, a\nchildless box that resolves to a pathologically tall height was amplified into\nthousands of blank PDF pages, even when it produces no visible output.\n\nThe childless-collapse defense that would normally collapse such a box was gated\nby a tag-only \"replaced content\" check, so any **non-painting replaced element**\nbypassed it, including:\n\n- an unresolved `src` (the common offline-first case),\n- a `visibility:hidden` image,\n- an undecodable image format, and\n- an empty `\u003csvg\u003e`.\n\nA trailing-sibling variant of the same gap was also open. A few bytes of HTML\ntherefore amplified into roughly `MAX_PAGES` (10,000) blank pages; the renderer\nallocates and runs a per-page loop over them, producing CPU and memory\nexhaustion. An attacker able to submit HTML to a fulgur-based conversion service\ncan trigger this with a trivially small payload, denying service to the host and\nany co-tenants.\n\n## Patches\n\nFixed in **0.26.0** (PR #575). The tag-only gate was removed so that any\npathologically tall childless box collapses regardless of whether it is a\nreplaced element, closing the missing-`src`, `visibility:hidden`,\nundecodable-format, and empty-`\u003csvg\u003e` vectors at once, along with the\ntrailing-sibling variant.\n\n## Workarounds\n\nUpgrade to 0.26.0 or later. If upgrading is not immediately possible, validate\nor constrain untrusted CSS (in particular very large `height` / `vh` on\nelements) before passing HTML to fulgur.\n\n## Related\n\nVersions prior to 0.19.0 additionally lacked any page-count cap, allowing an\nunbounded (rather than 10,000-page) variant of this amplification and a\nnon-terminating loop on non-finite heights. That earlier variant is tracked\nseparately as GHSA-j5cx-ph8g-95v3.\n\n## Attack Vector rationale\n\n`fulgur` performs no network I/O of its own; it renders HTML/CSS handed to it by\nthe embedding application. This advisory scores the crate independent of any\nspecific adopting program, so per the CVSS v3.1 User Guide §3.7 (scoring library\nvulnerabilities related to incoming data) the Attack Vector is assessed as\n**Network** for the reasonable worst-case deployment — a network-facing service\nthat renders untrusted, attacker-supplied HTML without user interaction. A\nconcrete system that receives the HTML in one component and passes it to fulgur\nin a separate component may assess a lower environmental Attack Vector (Local,\nper §3.10).\n\n## References\n\n- Fix: https://github.com/fulgur-rs/fulgur/pull/575","status":"published","published":"2026-09-17T18:49:15Z","modified":"2026-09-17T18:49:16Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:41:18.357514Z"}],"nvd":[{"id":"CVE-2026-68537","description":"`fulgur` converts untrusted HTML/CSS into PDF, commonly on a server that processes input supplied by many tenants. In versions prior to 0.19.0, a body-direct child whose CSS-resolved height greatly exceeds the page height was sliced into one fragment per page with no upper bound. This is fixed in version 0.19.0. A `MAX_PAGES` cap bounds the slice loop — halting it even for a `+inf` height — and non-finite layout heights are sanitized so they can no longer drive the loop. As a workaround, validate or constrain untrusted CSS (in particular `height` / `vh` on body-level elements) before passing HTML to fulgur.","status":"published","published":"2026-09-17T21:17:19.87Z","modified":"2026-09-24T21:25:27.05Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-400","CWE-835"],"updated_at":"2026-11-02T14:12:49.70655Z"}],"osv":[{"id":"CVE-2026-68537","title":"Fulgur: Unbounded page slicing from attacker-controlled CSS height causes denial of service","description":"`fulgur` converts untrusted HTML/CSS into PDF, commonly on a server that processes input supplied by many tenants. In versions prior to 0.19.0, a body-direct child whose CSS-resolved height greatly exceeds the page height was sliced into one fragment per page with no upper bound. This is fixed in version 0.19.0. A `MAX_PAGES` cap bounds the slice loop — halting it even for a `+inf` height — and non-finite layout heights are sanitized so they can no longer drive the loop. As a workaround, validate or constrain untrusted CSS (in particular `height` / `vh` on body-level elements) before passing HTML to fulgur.","status":"published","published":"2026-09-17T20:18:59.957Z","modified":"2026-10-28T02:30:54.434635096Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-400","CWE-835"],"updated_at":"2026-11-02T15:45:14.808935Z"},{"id":"GHSA-4rf6-qx84-q9fv","title":"Fulgur: Non-painting replaced elements amplify to thousands of blank PDF pages (denial of service)","description":"`fulgur` converts untrusted HTML/CSS into PDF, commonly on a server that\nprocesses input supplied by many tenants. In versions prior to 0.26.0, a\nchildless box that resolves to a pathologically tall height was amplified into\nthousands of blank PDF pages, even when it produces no visible output.\n\nThe childless-collapse defense that would normally collapse such a box was gated\nby a tag-only \"replaced content\" check, so any **non-painting replaced element**\nbypassed it, including:\n\n- an unresolved `src` (the common offline-first case),\n- a `visibility:hidden` image,\n- an undecodable image format, and\n- an empty `\u003csvg\u003e`.\n\nA trailing-sibling variant of the same gap was also open. A few bytes of HTML\ntherefore amplified into roughly `MAX_PAGES` (10,000) blank pages; the renderer\nallocates and runs a per-page loop over them, producing CPU and memory\nexhaustion. An attacker able to submit HTML to a fulgur-based conversion service\ncan trigger this with a trivially small payload, denying service to the host and\nany co-tenants.\n\n## Patches\n\nFixed in **0.26.0** (PR #575). The tag-only gate was removed so that any\npathologically tall childless box collapses regardless of whether it is a\nreplaced element, closing the missing-`src`, `visibility:hidden`,\nundecodable-format, and empty-`\u003csvg\u003e` vectors at once, along with the\ntrailing-sibling variant.\n\n## Workarounds\n\nUpgrade to 0.26.0 or later. If upgrading is not immediately possible, validate\nor constrain untrusted CSS (in particular very large `height` / `vh` on\nelements) before passing HTML to fulgur.\n\n## Related\n\nVersions prior to 0.19.0 additionally lacked any page-count cap, allowing an\nunbounded (rather than 10,000-page) variant of this amplification and a\nnon-terminating loop on non-finite heights. That earlier variant is tracked\nseparately as GHSA-j5cx-ph8g-95v3.\n\n## Attack Vector rationale\n\n`fulgur` performs no network I/O of its own; it renders HTML/CSS handed to it by\nthe embedding application. This advisory scores the crate independent of any\nspecific adopting program, so per the CVSS v3.1 User Guide §3.7 (scoring library\nvulnerabilities related to incoming data) the Attack Vector is assessed as\n**Network** for the reasonable worst-case deployment — a network-facing service\nthat renders untrusted, attacker-supplied HTML without user interaction. A\nconcrete system that receives the HTML in one component and passes it to fulgur\nin a separate component may assess a lower environmental Attack Vector (Local,\nper §3.10).\n\n## References\n\n- Fix: https://github.com/fulgur-rs/fulgur/pull/575","status":"published","published":"2026-09-17T18:49:15Z","modified":"2026-09-17T19:10:53.126200232Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T15:46:37.528068Z"},{"id":"RUSTSEC-2026-0201","title":"Non-painting replaced elements amplify to thousands of blank PDF pages (denial of service)","description":"`fulgur` converts untrusted HTML/CSS into PDF, commonly on a server that\nprocesses input supplied by many tenants. In versions prior to 0.26.0, a\nchildless box that resolves to a pathologically tall height was amplified into\nthousands of blank PDF pages, even when it produces no visible output.\n\nThe childless-collapse defense that would normally collapse such a box was gated\nby a tag-only \"replaced content\" check, so any non-painting replaced element\nbypassed it, including an unresolved `src` (the common offline-first case), a\n`visibility:hidden` image, an undecodable image format, and an empty `\u003csvg\u003e`. A\ntrailing-sibling variant of the same gap was also open.\n\nA few bytes of HTML therefore amplified into roughly `MAX_PAGES` (10,000) blank\npages; the renderer allocates and runs a per-page loop over them, producing CPU\nand memory exhaustion. An attacker able to submit HTML to a fulgur-based\nconversion service can trigger this with a trivially small payload, denying\nservice to the host and any co-tenants.\n\nFixed in 0.26.0: the tag-only gate was removed so that any pathologically tall\nchildless box collapses regardless of whether it is a replaced element, closing\nthe missing-`src`, `visibility:hidden`, undecodable-format, and empty-`\u003csvg\u003e`\nvectors along with the trailing-sibling variant.\n\nVersions prior to 0.19.0 additionally lacked any page-count cap, allowing an\nunbounded (rather than 10,000-page) variant of this amplification; that earlier\nvariant is tracked separately as GHSA-j5cx-ph8g-95v3.\n\n## Attack Vector rationale\n\n`fulgur` performs no network I/O of its own; it renders HTML/CSS handed to it by\nthe embedding application. This advisory scores the crate independent of any\nspecific adopting program, so per the CVSS v3.1 User Guide §3.7 the Attack\nVector is assessed as Network for the reasonable worst-case deployment — a\nnetwork-facing service that renders untrusted HTML without user interaction. A\nconcrete system that receives the HTML in one component and passes it to fulgur\nin a separate component may assess a lower environmental Attack Vector (Local,\nper §3.10).","status":"published","published":"2026-07-05T12:00:00Z","modified":"2026-10-12T18:00:14.31121082Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:40.430679Z"}]}}