CVE-2026-68540: fulgur: Quadratic style-list reprocessing during containing-block resolution for absolutely-positioned pseudo-elements causes denial of servicefulgur:
fulgur converts untrusted HTML/CSS into PDF, commonly on a server that processes input supplied by many tenants. From version 0.6.0 to before version 0.33.0, quadratic style-list reprocessing during containing-block resolution for absolutely-positioned pseudo-elements cause denial of service. This issue has been patched in version 0.33.0.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
fulgurto a version that resolves this vulnerability.Fixed in 0.33.0
Event History
Frequently Asked Questions
Which deployments are most exposed to this issue?
Servers that use fulgur to convert HTML/CSS supplied by untrusted users or tenants are most exposed, because crafted input can be processed by the PDF conversion service.
What does an attacker need to exploit the issue?
An attacker needs to provide HTML/CSS that is processed by a vulnerable fulgur instance. The listed vector indicates network reachability, low attack complexity, and no required privileges or user interaction.
Which versions are affected and what version fixes it?
Versions from 0.6.0 up to, but not including, 0.33.0 are affected. The issue is patched in version 0.33.0.