{"id":"CVE-2026-68540","kind":"vulnerability","aliases":["CVE-2026-68540"],"related":[],"title":"fulgur: quadratic CSS processing lets crafted HTML cause denial of service","description":"fulgur converts untrusted HTML/CSS into PDF, commonly on a server that processes input supplied by many tenants. From version 0.6.0 to before version 0.33.0, quadratic style-list reprocessing during containing-block resolution for absolutely-positioned pseudo-elements cause denial of service. This issue has been patched in version 0.33.0.","summary":"fulgur, a library that converts HTML and CSS into PDF, spends quadratic time reprocessing style lists when absolutely-positioned pseudo-elements are resolved. Crafted untrusted HTML/CSS can make the conversion hang or exhaust resources, denying service to other users.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["fulgur","multi-tenant","package","pdf-generation"],"not_affected_if":["fulgur-below-0.6.0-or-0.33.0-plus","trusted-input-only"],"how_to_check":"- Check the fulgur version in your lockfile or Cargo manifest; affected versions are from `0.6.0` up to but not including `0.33.0`.\n- Find places where fulgur renders HTML or CSS supplied by users or tenants.","fix":"- fulgur: upgrade to `0.33.0`","status":"open","published_at":"2026-11-11T22:17:30+00:00","first_seen_at":"2026-11-11T22:29:35+00:00","triaged_at":"2026-11-11T22:31:53+00:00","updated_at":"2026-11-11T22:31:53+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-11T22:31:53Z","model":"claude-haiku-5-5","output":{"fix":"- fulgur: upgrade to `0.33.0`","reach":"network","title":"fulgur: quadratic CSS processing lets crafted HTML cause denial of service","impact":"low","summary":"fulgur, a library that converts HTML and CSS into PDF, spends quadratic time reprocessing style lists when absolutely-positioned pseudo-elements are resolved. Crafted untrusted HTML/CSS can make the conversion hang or exhaust resources, denying service to other users.","audience":"developers","category":"package","nicknames":[],"who_cares":["fulgur","pdf-generation","multi-tenant"],"confidence":0.6,"fix_status":"available","needs_auth":"unknown","worst_case":"Server process stalls or runs out of resources, denying service","analyst_note":"product_ecosystem and product_name not provided; registry unknown","how_to_check":"- Check the fulgur version in your lockfile or Cargo manifest; affected versions are from `0.6.0` up to but not including `0.33.0`.\n- Find places where fulgur renders HTML or CSS supplied by users or tenants.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["trusted-input-only","fulgur-below-0.6.0-or-0.33.0-plus"],"who_is_affected":"Applications that embed fulgur and render untrusted HTML/CSS to PDF, especially multi-tenant servers where many users submit input. Applications that only render trusted, internally authored templates are much less exposed.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000741,"input_tokens":4616,"output_tokens":558,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-68540':14A,17A '0.33.0':90C,119C '0.6.0':86C 'absolut':44B,103C 'absolutely-posit':43B,102C 'block':99C 'caus':8A,108C 'common':73C 'contain':98C 'containing-block':97C 'convers':57B 'convert':30B,68C 'craft':6A,51B 'css':3A,33B 'cve':12A,15A 'deni':62B 'denial':9A,109C 'element':48B,107C 'exhaust':60B 'fulgur':1A,18B,26B,67C 'generat':25B 'hang':58B 'html':7A,31B 'html/css':53B,70C 'input':79C 'issu':113C 'let':5A 'librari':28B 'list':41B,94C 'make':55B 'mani':82C 'multi':20B 'multi-ten':19B 'packag':22B 'patch':116C 'pdf':24B,35B,72C 'pdf-gener':23B 'posit':45B,104C 'process':4A,78C 'pseudo':47B,106C 'pseudo-el':46B,105C 'quadrat':2A,37B,91C 'reprocess':39B,95C 'resolut':100C 'resolv':50B 'resourc':61B 'server':76C 'servic':11A,63B,111C 'spend':36B 'style':40B,93C 'style-list':92C 'suppli':80C 'tenant':21B,83C 'time':38B 'untrust':52B,69C 'user':66B 'version':85C,89C,118C","nicknames":[],"mitigations":[],"who_affected":"Applications that embed fulgur and render untrusted HTML/CSS to PDF, especially multi-tenant servers where many users submit input. Applications that only render trusted, internally authored templates are much less exposed.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["fulgur","high","multitenant","package","pdfgeneration"],"campaign_type":null,"search_a":"'-2026':13A,16A '-68540':14A,17A 'caus':8A 'craft':6A 'css':3A 'cve':12A,15A 'denial':9A 'fulgur':1A 'html':7A 'let':5A 'process':4A 'quadrat':2A 'servic':11A","search_b":"'absolut':44B 'absolutely-posit':43B 'convers':57B 'convert':30B 'craft':51B 'css':33B 'deni':62B 'element':48B 'exhaust':60B 'fulgur':18B,26B 'generat':25B 'hang':58B 'html':31B 'html/css':53B 'librari':28B 'list':41B 'make':55B 'multi':20B 'multi-ten':19B 'packag':22B 'pdf':24B,35B 'pdf-gener':23B 'posit':45B 'pseudo':47B 'pseudo-el':46B 'quadrat':37B 'reprocess':39B 'resolv':50B 'resourc':61B 'servic':63B 'spend':36B 'style':40B 'tenant':21B 'time':38B 'untrust':52B 'user':66B","search_c":"'0.33.0':90C,119C '0.6.0':86C 'absolut':103C 'absolutely-posit':102C 'block':99C 'caus':108C 'common':73C 'contain':98C 'containing-block':97C 'convert':68C 'denial':109C 'element':107C 'fulgur':67C 'html/css':70C 'input':79C 'issu':113C 'list':94C 'mani':82C 'patch':116C 'pdf':72C 'posit':104C 'process':78C 'pseudo':106C 'pseudo-el':105C 'quadrat':91C 'reprocess':95C 'resolut':100C 'server':76C 'servic':111C 'style':93C 'style-list':92C 'suppli':80C 'tenant':83C 'untrust':69C 'version':85C,89C,118C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-07-07T17:23:32+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-68540","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68540","severity":null,"published_at":"2026-11-11T22:17:30+00:00","modified_at":"2026-11-11T22:17:30+00:00","first_seen_at":"2026-11-11T22:29:35+00:00","fetched_at":"2026-11-11T22:29:35+00:00","note":null}],"documents":[{"id":129475,"url":"https://github.com/fulgur-rs/fulgur/commit/8fabbca271313c56ef48f1d20d0040e1cf130de5","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":129476,"url":"https://github.com/fulgur-rs/fulgur/releases/tag/v0.33.0","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":129477,"url":"https://github.com/fulgur-rs/fulgur/security/advisories/GHSA-v8x5-rchq-jr47","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-07-07T17:23:32+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}