GHSA-j5cx-ph8g-95v3: High severity rust/fulgur vulnerability
fulgur converts untrusted HTML/CSS into PDF, commonly on a server that processes input supplied by many tenants. In versions prior to 0.19.0, a body-direct child whose CSS-resolved height greatly exceeds the page height was sliced into one fragment per page with no upper bound.
The height is taken directly from attacker-controlled HTML/CSS (height, vh units), so a few bytes such as:
html <div style="height:99999999px"></div>
forced on the order of 125,000 page fragments. The pagination code then allocates vec![Vec::new(); pagecount] and runs a per-page render loop, resulting in CPU and memory exhaustion. A non-finite height (one that resolves to +inf) additionally made the slicing loop's remaining -= lastsliceh decrement never terminate, causing an infinite loop.
An attacker able to submit HTML/CSS to a fulgur-based conversion service can trigger this with a trivially small payload, denying service to the host and any co-tenants.
Patches
Fixed in 0.19.0. A MAXPAGES cap bounds the slice loop — halting it even for a +inf height — and non-finite layout heights are sanitized so they can no longer drive the loop.
Workarounds
Upgrade to 0.19.0 or later. If upgrading is not immediately possible, validate or constrain untrusted CSS (in particular height / vh on body-level elements) before passing HTML to fulgur.
Attack Vector rationale
fulgur performs no network I/O of its own; it renders HTML/CSS handed to it by the embedding application. This advisory scores the crate independent of any specific adopting program, so per the CVSS v3.1 User Guide §3.7 (scoring library vulnerabilities related to incoming data) the Attack Vector is assessed as Network for the reasonable worst-case deployment — a network-facing service that renders untrusted, attacker-supplied HTML without user interaction. A concrete system that receives the HTML in one component and passes it to fulgur in a separate component may assess a lower environmental Attack Vector (Local, per §3.10).
References
- Fix: https://github.com/fulgur-rs/fulgur/pull/501
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rust/fulgurto a version that resolves this vulnerability.Fixed in 0.19.0 - Upgrade
Upgrade
fulgurto a version that resolves this vulnerability.Fixed in 0.19.0 - Configuration
If upgrading to 0.19.0 or later is not immediately possible, validate incoming HTML/CSS from untrusted users/tenants and constrain or sanitize non-finite layout heights derived from attacker-controlled CSS properties like `height`/`vh` on body-direct child elements before passing the HTML to fulgur to prevent the infinite pagination/slicing loop.
fulgur-based conversion service (embedding application) constrain untrusted CSS height/vh on body-level elements (sanitize/validate) = sanitizing non-finite heights (e.g., disallow +inf) and/or constraining height/vh to a finite maximum before passing HTML to fulgur
Event History
Frequently Asked Questions
Which deployments are most exposed to this issue?
Services that use fulgur to convert HTML/CSS supplied by untrusted users are exposed, particularly shared or multi-tenant conversion services. A successful attack can exhaust host CPU and memory and disrupt co-tenants.
What level of attacker access is required?
An attacker only needs to be able to submit HTML/CSS for conversion. No authentication, user interaction, or special privileges are required by the supplied severity vector.
Which versions contain the fix?
The issue is fixed in fulgur 0.19.0. The fix caps the number of generated pages and sanitizes non-finite layout heights, preventing both excessive page generation and the infinite-loop condition.