TI-2026-48287 Aliases CVE-2026-68523 GHSA-j5cx-ph8g-95v3

Fulgur: Unbounded page slicing from attacker-controlled CSS height causes denial of service

MEDIUM 40CWE-400Published 2026-09-17 · Updated 2026-09-21

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Denial of service
Confidentiality · integrity · availability: None · None · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-400.

Summary

`fulgur` converts untrusted HTML/CSS into PDF, commonly on a server that processes input supplied by many tenants. In versions prior to 0.19.0, a body-direct child whose CSS-resolved height greatly exceeds the page height was sliced into one fragment per page with no upper bound. This is fixed in 0.19.0. A `MAX_PAGES` cap bounds the slice loop — halting it even for a `+inf` height — and non-finite layout heights are sanitized so they can no longer drive the loop. As a workaround, validate or constrain untrusted CSS (in particular `height` / `vh` on body-level elements) before passing HTML to fulgur.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00609 49th percentileScored 2026-11-07

Fix Fixed fulgur (fulgur-rs): 0.19.0fulgur (crates.io): 0.19.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
fulgur-rs	fulgur	before 0.19.0	0.19.0	Patch available	CNA
—	fulgur (crates.io)	before 0.19.0	0.19.0	Patch available	GHSA-j5cx-ph8g-95v3

fulgur Vendorfulgur-rs Affected before 0.19.0 Fixed in 0.19.0 Patch available CNA
fulgur (crates.io) Vendor— Affected before 0.19.0 Fixed in 0.19.0 Patch available GHSA-j5cx-ph8g-95v3

Remediation

Fix · CNA fulgur (fulgur-rs) Fixed in 0.19.0
Fix · GHSA-j5cx-ph8g-95v3 fulgur (crates.io) Fixed in 0.19.0 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2026-68523
2026-10-03 Alias added: GHSA-j5cx-ph8g-95v3

References

Other 4

TI-2026-48300 Fulgur: Unbounded page slicing from attacker-controlled CSS height causes denial of service CVSS 3.1HIGH 7.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences