CVE-2026-68537 — Fulgur: Unbounded page slicing from attacker-controlled CSS height causes denial of service

Affected: fulgur-rs fulgur

`fulgur` converts untrusted HTML/CSS into PDF, commonly on a server that processes input supplied by many tenants. In versions prior to 0.19.0, a body-direct child whose CSS-resolved height greatly exceeds the page height was sliced into one fragment per page with no upper bound. This is fixed in version 0.19.0. A `MAX_PAGES` cap bounds the slice loop — halting it even for a `+inf` height — and non-finite layout heights are sanitized so they can no longer drive the loop. As a workaround, validate or constrain untrusted CSS (in particular `height` / `vh` on body-level elements) before passing HTML to fulgur.

GHSA-4rf6-qx84-q9fv — Fulgur: Non-painting replaced elements amplify to thousands of blank PDF pages (denial of service)

Affected: crates.io: fulgur

`fulgur` converts untrusted HTML/CSS into PDF, commonly on a server that processes input supplied by many tenants. In versions prior to 0.26.0, a childless box that resolves to a pathologically tall height was amplified into thousands of blank PDF pages, even when it produces no visible output.

The childless-collapse defense that would normally collapse such a box was gated by a tag-only "replaced content" check, so any **non-painting replaced element** bypassed it, including:

- an unresolved `src` (the common offline-first case), - a `visibility:hidden` image, - an undecodable image format, and - an empty `<svg>`.

A trailing-sibling variant of the same gap was also open. A few bytes of HTML therefore amplified into roughly `MAX_PAGES` (10,000) blank pages; the renderer allocates and runs a per-page loop over them, producing CPU and memory exhaustion. An attacker able to submit HTML to a fulgur-based conversion service can trigger this with a trivially small payload, denying service to the host and any co-tenants.

## Patches

Fixed in **0.26.0** (PR #575). The tag-only gate was removed so that any pathologically tall childless box collapses regardless of whether it is a replaced element, closing the missing-`src`, `visibility:hidden`, undecodable-format, and empty-`<svg>` vectors at once, along with the trailing-sibling variant.

## Workarounds

Upgrade to 0.26.0 or later. If upgrading is not immediately possible, validate or constrain untrusted CSS (in particular very l…

Most recent entries from all

CVE-2026-68537 — Fulgur: Unbounded page slicing from attacker-controlled CSS height causes denial of service

GHSA-4rf6-qx84-q9fv — Fulgur: Non-painting replaced elements amplify to thousands of blank PDF pages (denial of service)