fulgur converts untrusted HTML/CSS into PDF, commonly on a server that processes input supplied by many tenants. From version 0.15.0 to before version 0.27.0, resolving the CSS counters(name, sep) function in generated content was bounded neither in the size of a single expansion nor in the aggregate work across an element tree. An attacker able to submit HTML/CSS to a fulgur-based conversion service can trigger CPU and memory exhaustion with a trivially small payload, denying service to the host and any co-tenants. This issue has been patched in version 0.27.0.
Metrics
Affected Vendors & Products
No data.
No data.
No data.
No data.
Advisories
No advisories yet.
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
History
Wed, 11 Nov 2026 22:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | fulgur converts untrusted HTML/CSS into PDF, commonly on a server that processes input supplied by many tenants. From version 0.15.0 to before version 0.27.0, resolving the CSS counters(name, sep) function in generated content was bounded neither in the size of a single expansion nor in the aggregate work across an element tree. An attacker able to submit HTML/CSS to a fulgur-based conversion service can trigger CPU and memory exhaustion with a trivially small payload, denying service to the host and any co-tenants. This issue has been patched in version 0.27.0. | |
| Title | fulgur: Unbounded counters() expansion in generated content causes memory/CPU exhaustion (denial of service) | |
| Weaknesses | CWE-400 | |
| References |
| |
| Metrics |
cvssV3_1
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: GitHub_M
Published:
Updated: 2026-11-11T22:12:06.386Z
Reserved: 2026-07-30T19:56:44.101Z
Link: CVE-2026-68538
Vulnrichment
No data.
NVD
Status : Deferred
Published: 2026-11-11T22:17:30.313
Modified: 2026-11-11T22:17:30.440
Link: CVE-2026-68538
Redhat
No data.
OpenCVE Enrichment
No data.
Weaknesses