{"id":"CVE-2026-68539","kind":"vulnerability","aliases":["CVE-2026-68539"],"related":[],"title":"fulgur: crafted HTML/CSS document exhausts server memory and CPU","description":"fulgur converts untrusted HTML/CSS into PDF, commonly on a server that processes input supplied by many tenants. From version 0.4.4 to before version 0.29.0, the CSS string-set named-string values resolved from a document were accumulated per element with no memory budget, letting a small crafted document amplify into large retained memory (and the CPU to copy it) — results in a denial of service. This issue has been patched in version 0.29.0.","summary":"fulgur is a library that converts HTML and CSS into PDF files. A small crafted document makes it accumulate unbounded memory and CPU work, so an attacker can cause a denial of service.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["multi-tenant","package","pdf-generation","server-side-rendering"],"not_affected_if":["trusted-input-only","versions-outside-range"],"how_to_check":"- Check the fulgur version in your lockfile or Cargo manifest; affected versions are `0.4.4` up to but not including `0.29.0`\n- Find whether your service passes untrusted HTML or CSS to fulgur for PDF rendering","fix":"- fulgur: upgrade to `0.29.0` or later","status":"open","published_at":"2026-11-11T22:17:30+00:00","first_seen_at":"2026-11-11T22:29:35+00:00","triaged_at":"2026-11-11T22:31:55+00:00","updated_at":"2026-11-11T22:31:55+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-11T22:31:55Z","model":"claude-haiku-5-5","output":{"fix":"- fulgur: upgrade to `0.29.0` or later","reach":"unknown","title":"fulgur: crafted HTML/CSS document exhausts server memory and CPU","impact":"low","summary":"fulgur is a library that converts HTML and CSS into PDF files. A small crafted document makes it accumulate unbounded memory and CPU work, so an attacker can cause a denial of service.","audience":"developers","category":"package","nicknames":[],"who_cares":["pdf-generation","server-side-rendering","multi-tenant"],"confidence":0.6,"fix_status":"available","needs_auth":"unknown","worst_case":"Server memory and CPU exhausted by a small crafted document, causing denial of service","analyst_note":"Ecosystem and exact package name are not stated in the sources; confirm the registry before publishing.','product_name':'fulgur'}","how_to_check":"- Check the fulgur version in your lockfile or Cargo manifest; affected versions are `0.4.4` up to but not including `0.29.0`\n- Find whether your service passes untrusted HTML or CSS to fulgur for PDF rendering","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["trusted-input-only","versions-outside-range"],"who_is_affected":"Services that render PDFs from HTML or CSS supplied by users or other tenants are exposed, since a single crafted document can exhaust memory. Applications that only render trusted, internally authored templates are less exposed. unknown whether the sources list other ecosystems or package names.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.00075,"input_tokens":4654,"output_tokens":569,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':11A,14A '-68539':12A,15A '0.29.0':83C,134C '0.4.4':79C 'accumul':45B,98C 'amplifi':110C 'attack':53B 'budget':104C 'caus':55B 'common':66C 'convert':32B,61C 'copi':119C 'cpu':9A,49B,117C 'craft':2A,41B,108C 'css':35B,85C 'cve':10A,13A 'denial':57B,124C 'document':4A,42B,96C,109C 'element':100C 'exhaust':5A 'file':38B 'fulgur':1A,27B,60C 'generat':22B 'html':33B 'html/css':3A,63C 'input':72C 'issu':128C 'larg':112C 'let':105C 'librari':30B 'make':43B 'mani':75C 'memori':7A,47B,103C,114C 'multi':17B 'multi-ten':16B 'name':90C 'named-str':89C 'packag':19B 'patch':131C 'pdf':21B,37B,65C 'pdf-gener':20B 'per':99C 'process':71C 'render':26B 'resolv':93C 'result':121C 'retain':113C 'server':6A,24B,69C 'server-side-rend':23B 'servic':59B,126C 'set':88C 'side':25B 'small':40B,107C 'string':87C,91C 'string-set':86C 'suppli':73C 'tenant':18B,76C 'unbound':46B 'untrust':62C 'valu':92C 'version':78C,82C,133C 'work':50B","nicknames":[],"mitigations":[],"who_affected":"Services that render PDFs from HTML or CSS supplied by users or other tenants are exposed, since a single crafted document can exhaust memory. Applications that only render trusted, internally authored templates are less exposed. unknown whether the sources list other ecosystems or package names.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","multitenant","package","pdfgeneration","serversiderendering"],"campaign_type":null,"search_a":"'-2026':11A,14A '-68539':12A,15A 'cpu':9A 'craft':2A 'cve':10A,13A 'document':4A 'exhaust':5A 'fulgur':1A 'html/css':3A 'memori':7A 'server':6A","search_b":"'accumul':45B 'attack':53B 'caus':55B 'convert':32B 'cpu':49B 'craft':41B 'css':35B 'denial':57B 'document':42B 'file':38B 'fulgur':27B 'generat':22B 'html':33B 'librari':30B 'make':43B 'memori':47B 'multi':17B 'multi-ten':16B 'packag':19B 'pdf':21B,37B 'pdf-gener':20B 'render':26B 'server':24B 'server-side-rend':23B 'servic':59B 'side':25B 'small':40B 'tenant':18B 'unbound':46B 'work':50B","search_c":"'0.29.0':83C,134C '0.4.4':79C 'accumul':98C 'amplifi':110C 'budget':104C 'common':66C 'convert':61C 'copi':119C 'cpu':117C 'craft':108C 'css':85C 'denial':124C 'document':96C,109C 'element':100C 'fulgur':60C 'html/css':63C 'input':72C 'issu':128C 'larg':112C 'let':105C 'mani':75C 'memori':103C,114C 'name':90C 'named-str':89C 'patch':131C 'pdf':65C 'per':99C 'process':71C 'resolv':93C 'result':121C 'retain':113C 'server':69C 'servic':126C 'set':88C 'small':107C 'string':87C,91C 'string-set':86C 'suppli':73C 'tenant':76C 'untrust':62C 'valu':92C 'version':78C,82C,133C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-07-05T18:39:47+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-68539","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68539","severity":null,"published_at":"2026-11-11T22:17:30+00:00","modified_at":"2026-11-11T22:17:30+00:00","first_seen_at":"2026-11-11T22:29:35+00:00","fetched_at":"2026-11-11T22:29:35+00:00","note":null}],"documents":[{"id":129471,"url":"https://github.com/fulgur-rs/fulgur/commit/1c4cdad003daef7c9dc6ef1362c50bcfaac13ea9","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":129472,"url":"https://github.com/fulgur-rs/fulgur/commit/9248fbfd91a2ba8fc3dbd9e44ba681f52ed1ecd0","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":129473,"url":"https://github.com/fulgur-rs/fulgur/releases/tag/v0.29.0","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":129474,"url":"https://github.com/fulgur-rs/fulgur/security/advisories/GHSA-vw2v-g4x7-xcqg","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-07-05T18:39:47+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}