CVE-2026-68537: CWE-400: Uncontrolled Resource Consumption in fulgur-rs fulgur
`fulgur` converts untrusted HTML/CSS into PDF, commonly on a server that processes input supplied by many tenants. In versions prior to 0.19.0, a body-direct child whose CSS-resolved height greatly exceeds the page height was sliced into one fragment per page with no upper bound. This is fixed in version 0.19.0. A `MAX_PAGES` cap bounds the slice loop — halting it even for a `+inf` height — and non-finite layout heights are sanitized so they can no longer drive the loop. As a workaround, validate or constrain untrusted CSS (in particular `height` / `vh` on body-level elements) before passing HTML to fulgur.
AI Analysis
Technical Summary
The fulgur library converts untrusted HTML/CSS into PDF, often in multi-tenant server environments. In versions before 0.19.0, if a body-direct child element has a CSS-resolved height that greatly exceeds the page height, the library slices this element into one fragment per page with no upper limit, causing uncontrolled resource consumption (CWE-400). This vulnerability can be exploited by supplying malicious CSS to cause denial of service by exhausting system resources. The flaw is addressed in version 0.19.0 by implementing a MAX_PAGES cap to limit the number of slices and sanitizing non-finite layout heights to prevent infinite loops. As a workaround, users should validate or constrain untrusted CSS, especially height and viewport height (vh) properties on body-level elements, before passing HTML to fulgur.
Potential Impact
This vulnerability can lead to denial of service by exhausting system resources due to unbounded slicing of elements with extremely large CSS-resolved heights during PDF generation. It does not impact confidentiality or integrity but can cause availability issues on servers processing untrusted input.
Mitigation Recommendations
A fix is available in fulgur version 0.19.0 that introduces a MAX_PAGES cap and sanitizes non-finite layout heights to prevent uncontrolled resource consumption. Users should upgrade to version 0.19.0 or later. As a temporary workaround, validate or constrain untrusted CSS input, particularly the height and vh properties on body-level elements, before passing HTML to fulgur.
CVE-2026-68537: CWE-400: Uncontrolled Resource Consumption in fulgur-rs fulgur
Description
`fulgur` converts untrusted HTML/CSS into PDF, commonly on a server that processes input supplied by many tenants. In versions prior to 0.19.0, a body-direct child whose CSS-resolved height greatly exceeds the page height was sliced into one fragment per page with no upper bound. This is fixed in version 0.19.0. A `MAX_PAGES` cap bounds the slice loop — halting it even for a `+inf` height — and non-finite layout heights are sanitized so they can no longer drive the loop. As a workaround, validate or constrain untrusted CSS (in particular `height` / `vh` on body-level elements) before passing HTML to fulgur.
CVSS v3.1
Score 7.5high
Affected software
fulgur-rs
fulgur
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The fulgur library converts untrusted HTML/CSS into PDF, often in multi-tenant server environments. In versions before 0.19.0, if a body-direct child element has a CSS-resolved height that greatly exceeds the page height, the library slices this element into one fragment per page with no upper limit, causing uncontrolled resource consumption (CWE-400). This vulnerability can be exploited by supplying malicious CSS to cause denial of service by exhausting system resources. The flaw is addressed in version 0.19.0 by implementing a MAX_PAGES cap to limit the number of slices and sanitizing non-finite layout heights to prevent infinite loops. As a workaround, users should validate or constrain untrusted CSS, especially height and viewport height (vh) properties on body-level elements, before passing HTML to fulgur.
Potential Impact
This vulnerability can lead to denial of service by exhausting system resources due to unbounded slicing of elements with extremely large CSS-resolved heights during PDF generation. It does not impact confidentiality or integrity but can cause availability issues on servers processing untrusted input.
Mitigation Recommendations
A fix is available in fulgur version 0.19.0 that introduces a MAX_PAGES cap and sanitizes non-finite layout heights to prevent uncontrolled resource consumption. Users should upgrade to version 0.19.0 or later. As a temporary workaround, validate or constrain untrusted CSS input, particularly the height and vh properties on body-level elements, before passing HTML to fulgur.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-07-30T19:56:44.100Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6aac51e955bf5e2cf5e0db7c
Added to database: 09/17/2026, 20:47:37 UTC
Last enriched: 09/17/2026, 21:01:53 UTC
Last updated: 09/18/2026, 00:40:34 UTC
Views: 7
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.