---
id: "CVE-2026-68540"
page: "https://infrastack.ai/live/CVE-2026-68540"
kind: "vulnerability"
aliases: ["CVE-2026-68540"]
title: "fulgur: quadratic CSS processing lets crafted HTML cause denial of service"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["fulgur", "multi-tenant", "package", "pdf-generation"]
not_affected_if: ["fulgur-below-0.6.0-or-0.33.0-plus", "trusted-input-only"]
published_at: "2026-11-11T22:17:30+00:00"
first_seen_at: "2026-11-11T22:29:35+00:00"
updated_at: "2026-11-11T22:31:53+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-68540", "first_seen_at": "2026-11-11T22:29:35+00:00"}]
exploit_sources: []
---

# fulgur: quadratic CSS processing lets crafted HTML cause denial of service

Link for people: https://infrastack.ai/live/CVE-2026-68540 (this .md is for agents)

fulgur, a library that converts HTML and CSS into PDF, spends quadratic time reprocessing style lists when absolutely-positioned pseudo-elements are resolved. Crafted untrusted HTML/CSS can make the conversion hang or exhaust resources, denying service to other users.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the fulgur version in your lockfile or Cargo manifest; affected versions are from `0.6.0` up to but not including `0.33.0`.
- Find places where fulgur renders HTML or CSS supplied by users or tenants.

## Fix

- fulgur: upgrade to `0.33.0`

## Timeline

- 2026-11-11T22:29:35+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-68540

## Documents

- [advisory] Vendor advisory: github.com https://github.com/fulgur-rs/fulgur/security/advisories/GHSA-v8x5-rchq-jr47
- [fix] Patch: github.com https://github.com/fulgur-rs/fulgur/commit/8fabbca271313c56ef48f1d20d0040e1cf130de5
- [fix] Release notes: github.com https://github.com/fulgur-rs/fulgur/releases/tag/v0.33.0

## From the sources

fulgur converts untrusted HTML/CSS into PDF, commonly on a server that processes input supplied by many tenants. From version 0.6.0 to before version 0.33.0, quadratic style-list reprocessing during containing-block resolution for absolutely-positioned pseudo-elements cause denial of service. This issue has been patched in version 0.33.0.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_