CVE-2026-68538 · Package
NO FIX YET · SEE WHAT TO DO
fulgur, a library that converts HTML/CSS to PDF, did not bound how much work resolving the CSS counters(name, sep) function takes. A small crafted HTML/CSS payload can exhaust CPU and memory, denying service to the host and any other tenants.
first public Jul 4, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Any service that lets outside users submit HTML/CSS that fulgur renders to PDF, especially multi-tenant conversion services. Applications that only render trusted, internally authored templates are much less exposed. unknown whether the sources list other affected products.
Not affected if trusted-input-only, version-0.27.0-or-later
Who cares fulgur, multi-tenant, pdf-generation, rust
0.15.0 up to but not including 0.27.0.0.27.0.fulgur converts untrusted HTML/CSS into PDF, commonly on a server that processes input supplied by many tenants. From version 0.15.0 to before version 0.27.0, resolving the CSS counters(name, sep) function in generated content was bounded neither in the size of a single expansion nor in the aggregate work across an element tree. An attacker able to submit HTML/CSS to a fulgur-based conversion service can trigger CPU and memory exhaustion with a trivially small payload, denying service to the host and any co-tenants. This issue has been patched in version 0.27.0.
This page as .md ·
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.