CVE-2026-68539: fulgur: Unbounded string-set value accumulation causes memory/CPU exhaustion (denial of service)
fulgur converts untrusted HTML/CSS into PDF, commonly on a server that processes input supplied by many tenants. From version 0.4.4 to before version 0.29.0, the CSS string-set named-string values resolved from a document were accumulated per element with no memory budget, letting a small crafted document amplify into large retained memory (and the CPU to copy it) — results in a denial of service. This issue has been patched in version 0.29.0.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
fulgurto a version that resolves this vulnerability.Fixed in 0.29.0
Event History
Frequently Asked Questions
Which deployments are most exposed to this issue?
Servers that use fulgur to convert HTML/CSS supplied by untrusted users are most exposed, particularly multi-tenant services. A remote attacker can submit a crafted document that exhausts memory and CPU during conversion.
What versions need to be remediated?
fulgur versions from 0.4.4 through versions before 0.29.0 are affected. Version 0.29.0 contains the patch.
Does exploitation require authentication or user interaction?
No. The reported vector is network-accessible, has low attack complexity, requires no privileges, and requires no user interaction.