CVE-2026-68537: Fulgur: Unbounded page slicing from attacker-controlled CSS height causes denial of service
fulgur converts untrusted HTML/CSS into PDF, commonly on a server that processes input supplied by many tenants. In versions prior to 0.26.0, a childless box that resolves to a pathologically tall height was amplified into thousands of blank PDF pages, even when it produces no visible output.
The childless-collapse defense that would normally collapse such a box was gated by a tag-only "replaced content" check, so any non-painting replaced element bypassed it, including:
- an unresolved src (the common offline-first case), - a visibility:hidden image, - an undecodable image format, and - an empty <svg>.
A trailing-sibling variant of the same gap was also open. A few bytes of HTML therefore amplified into roughly MAXPAGES (10,000) blank pages; the renderer allocates and runs a per-page loop over them, producing CPU and memory exhaustion. An attacker able to submit HTML to a fulgur-based conversion service can trigger this with a trivially small payload, denying service to the host and any co-tenants.
Patches
Fixed in 0.26.0 (PR #575). The tag-only gate was removed so that any pathologically tall childless box collapses regardless of whether it is a replaced element, closing the missing-src, visibility:hidden, undecodable-format, and empty-<svg> vectors at once, along with the trailing-sibling variant.
Workarounds
Upgrade to 0.26.0 or later. If upgrading is not immediately possible, validate or constrain untrusted CSS (in particular very large height / vh on elements) before passing HTML to fulgur.
Related
Versions prior to 0.19.0 additionally lacked any page-count cap, allowing an unbounded (rather than 10,000-page) variant of this amplification and a non-terminating loop on non-finite heights. That earlier variant is tracked separately as GHSA-j5cx-ph8g-95v3.
Attack Vector rationale
fulgur performs no network I/O of its own; it renders HTML/CSS handed to it by the embedding application. This advisory scores the crate independent of any specific adopting program, so per the CVSS v3.1 User Guide §3.7 (scoring library vulnerabilities related to incoming data) the Attack Vector is assessed as Network for the reasonable worst-case deployment — a network-facing service that renders untrusted, attacker-supplied HTML without user interaction. A concrete system that receives the HTML in one component and passes it to fulgur in a separate component may assess a lower environmental Attack Vector (Local, per §3.10).
References
- Fix: https://github.com/fulgur-rs/fulgur/pull/575
Other sources
fulgur converts untrusted HTML/CSS into PDF, commonly on a server that processes input supplied by many tenants. In versions prior to 0.19.0, a body-direct child whose CSS-resolved height greatly exceeds the page height was sliced into one fragment per page with no upper bound. This is fixed in version 0.19.0. A MAXPAGES cap bounds the slice loop — halting it even for a +inf height — and non-finite layout heights are sanitized so they can no longer drive the loop. As a workaround, validate or constrain untrusted CSS (in particular height / vh on body-level elements) before passing HTML to fulgur.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rust/fulgurto a version that resolves this vulnerability.Fixed in 0.26.0 - Upgrade
Upgrade
fulgur/fulgurto a version that resolves this vulnerability.Fixed in 0.26.0Patch PR #575 - Upgrade
Upgrade
fulgur/fulgurto a version that resolves this vulnerability.Fixed in 0.19.0 - Compensating control
As a workaround when upgrading is not immediately possible, validate or constrain untrusted CSS (in particular very large `height` / `vh` on body-level elements) before passing HTML to fulgur.
Event History
Frequently Asked Questions
Which deployments are most exposed?
Servers that use fulgur to convert HTML or CSS supplied by users are exposed, particularly multi-tenant conversion services. An attack can deny service to the host and other tenants sharing it.
What does an attacker need to exploit this issue?
The attacker needs the ability to submit HTML to a service that renders it with a vulnerable fulgur version. The payload can be trivially small and does not need to produce visible output.
Which inputs can trigger the excessive-page behavior?
Examples include a pathologically tall childless box containing a non-painting replaced element, such as an image with an unresolved src, a visibility:hidden image, an undecodable image, or an empty SVG. A trailing-sibling variant is also affected.
How can I determine whether my installation is affected?
Installations running fulgur versions earlier than 0.26.0 are affected. Version 0.26.0 contains the fix that collapses pathologically tall childless boxes regardless of replaced-element handling.
What should be done to remediate the issue?
Upgrade fulgur to version 0.26.0. The fix removes the tag-only replaced-content gate that allowed the affected boxes to bypass childless-collapse handling.