CVE-2026-68539
highfulgur converts untrusted HTML/CSS into PDF, commonly on a server that processes input supplied by many tenants.
fulgur converts untrusted HTML/CSS into PDF, commonly on a server that processes input supplied by many tenants. From version 0.4.4 to before version 0.29.0, the CSS string-set named-string values resolved from a document were accumulated per element with no memory budget, letting a small crafted document amplify into large retained memory (and the CPU to copy it) — results in a denial of service. This issue has been patched in version 0.29.0.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affected products
Not reported by the source (unknown — not "none").
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
No vendor advisory or patch reference tagged by NVD. Check the references below.
References
- https://github.com/fulgur-rs/fulgur/commit/1c4cdad003daef7c9dc6ef1362c50bcfaac13ea9 security-advisories@github.com
- https://github.com/fulgur-rs/fulgur/commit/9248fbfd91a2ba8fc3dbd9e44ba681f52ed1ecd0 security-advisories@github.com
- https://github.com/fulgur-rs/fulgur/pull/582 security-advisories@github.com
- https://github.com/fulgur-rs/fulgur/pull/584 security-advisories@github.com
- https://github.com/fulgur-rs/fulgur/releases/tag/v0.29.0 security-advisories@github.com
- https://github.com/fulgur-rs/fulgur/security/advisories/GHSA-vw2v-g4x7-xcqg security-advisories@github.com