---
id: "CVE-2026-68538"
page: "https://infrastack.ai/live/CVE-2026-68538"
kind: "vulnerability"
aliases: ["CVE-2026-68538"]
title: "fulgur: crafted CSS counters() input exhausts CPU and memory"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["fulgur", "multi-tenant", "package", "pdf-generation", "rust"]
not_affected_if: ["trusted-input-only", "version-0.27.0-or-later"]
published_at: "2026-11-11T22:17:30+00:00"
first_seen_at: "2026-11-11T22:29:35+00:00"
updated_at: "2026-11-11T22:31:58+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-68538", "first_seen_at": "2026-11-11T22:29:35+00:00"}]
exploit_sources: []
---

# fulgur: crafted CSS counters() input exhausts CPU and memory

Link for people: https://infrastack.ai/live/CVE-2026-68538 (this .md is for agents)

fulgur, a library that converts HTML/CSS to PDF, did not bound how much work resolving the CSS counters(name, sep) function takes. A small crafted HTML/CSS payload can exhaust CPU and memory, denying service to the host and any other tenants.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the fulgur version in your lockfile or Cargo.toml; affected range is `0.15.0` up to but not including `0.27.0`.
- Look for services that pass user-supplied HTML/CSS into fulgur for PDF rendering.

## Fix

- fulgur: upgrade to `0.27.0`.

## Timeline

- 2026-11-11T22:29:35+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-68538

## Documents

- [advisory] Vendor advisory: github.com https://github.com/fulgur-rs/fulgur/security/advisories/GHSA-395p-pj7r-jm42
- [fix] Patch: github.com https://github.com/fulgur-rs/fulgur/commit/ebc75691ad368f1c1a211543313b04da2af466d6
- [fix] Release notes: github.com https://github.com/fulgur-rs/fulgur/releases/tag/v0.27.0

## From the sources

fulgur converts untrusted HTML/CSS into PDF, commonly on a server that processes input supplied by many tenants. From version 0.15.0 to before version 0.27.0, resolving the CSS counters(name, sep) function in generated content was bounded neither in the size of a single expansion nor in the aggregate work across an element tree. An attacker able to submit HTML/CSS to a fulgur-based conversion service can trigger CPU and memory exhaustion with a trivially small payload, denying service to the host and any co-tenants. This issue has been patched in version 0.27.0.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_