CVE-2026-68539
HIGH
NVD
CVSS Score
7.5
Severity
HIGH
Published
Nov 11, 2026
Vendor
unknown
Description
fulgur converts untrusted HTML/CSS into PDF, commonly on a server that processes input supplied by many tenants. From version 0.4.4 to before version 0.29.0, the CSS string-set named-string values resolved from a document were accumulated per element with no memory budget, letting a small crafted document amplify into large retained memory (and the CPU to copy it) — results in a denial of service. This issue has been patched in version 0.29.0.
References
- https://github.com/fulgur-rs/fulgur/commit/1c4cdad003daef7c9dc6ef1362c50bcfaac13ea9
- https://github.com/fulgur-rs/fulgur/commit/9248fbfd91a2ba8fc3dbd9e44ba681f52ed1ecd0
- https://github.com/fulgur-rs/fulgur/pull/582
- https://github.com/fulgur-rs/fulgur/pull/584
- https://github.com/fulgur-rs/fulgur/releases/tag/v0.29.0