GHSA-4rf6-qx84-q9fv: High severity rust/fulgur vulnerability
fulgur converts untrusted HTML/CSS into PDF, commonly on a server that processes input supplied by many tenants. In versions prior to 0.26.0, a childless box that resolves to a pathologically tall height was amplified into thousands of blank PDF pages, even when it produces no visible output.
The childless-collapse defense that would normally collapse such a box was gated by a tag-only "replaced content" check, so any non-painting replaced element bypassed it, including:
- an unresolved src (the common offline-first case), - a visibility:hidden image, - an undecodable image format, and - an empty <svg>.
A trailing-sibling variant of the same gap was also open. A few bytes of HTML therefore amplified into roughly MAXPAGES (10,000) blank pages; the renderer allocates and runs a per-page loop over them, producing CPU and memory exhaustion. An attacker able to submit HTML to a fulgur-based conversion service can trigger this with a trivially small payload, denying service to the host and any co-tenants.
Patches
Fixed in 0.26.0 (PR #575). The tag-only gate was removed so that any pathologically tall childless box collapses regardless of whether it is a replaced element, closing the missing-src, visibility:hidden, undecodable-format, and empty-<svg> vectors at once, along with the trailing-sibling variant.
Workarounds
Upgrade to 0.26.0 or later. If upgrading is not immediately possible, validate or constrain untrusted CSS (in particular very large height / vh on elements) before passing HTML to fulgur.
Related
Versions prior to 0.19.0 additionally lacked any page-count cap, allowing an unbounded (rather than 10,000-page) variant of this amplification and a non-terminating loop on non-finite heights. That earlier variant is tracked separately as GHSA-j5cx-ph8g-95v3.
Attack Vector rationale
fulgur performs no network I/O of its own; it renders HTML/CSS handed to it by the embedding application. This advisory scores the crate independent of any specific adopting program, so per the CVSS v3.1 User Guide §3.7 (scoring library vulnerabilities related to incoming data) the Attack Vector is assessed as Network for the reasonable worst-case deployment — a network-facing service that renders untrusted, attacker-supplied HTML without user interaction. A concrete system that receives the HTML in one component and passes it to fulgur in a separate component may assess a lower environmental Attack Vector (Local, per §3.10).
References
- Fix: https://github.com/fulgur-rs/fulgur/pull/575
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rust/fulgurto a version that resolves this vulnerability.Fixed in 0.26.0 - Upgrade
Upgrade
fulgurto a version that resolves this vulnerability.Fixed in 0.26.0Patch PR #575 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch GHSA-j5cx-ph8g-95v3
Event History
Frequently Asked Questions
Who is exposed to this denial-of-service issue?
Services that use fulgur to convert untrusted, tenant-supplied HTML or CSS into PDFs are exposed. An attacker only needs to be able to submit conversion input, and can exhaust CPU and memory on the host and affect co-tenants.
What conditions can trigger the excessive blank-page generation?
Before 0.26.0, a pathologically tall childless box could bypass collapse when it was a non-painting replaced element. Examples include an image with an unresolved src, a visibility:hidden image, an undecodable image format, an empty SVG, and the trailing-sibling variant.
How severe can the resource consumption become?
A payload of only a few bytes can cause roughly MAX_PAGES, or 10,000, blank PDF pages to be generated. The renderer allocates resources and runs a per-page loop for those pages, causing CPU and memory exhaustion.
What version contains the fix?
The issue is fixed in fulgur 0.26.0. The fix removes the tag-only replaced-content gate so pathologically tall childless boxes collapse regardless of replaced-element status.