fulgur converts untrusted HTML/CSS into PDF, commonly on a server that processes input supplied by many tenants. From version 0.6.0 to before version 0.33.0, quadratic style-list reprocessing during containing-block resolution for absolutely-positioned pseudo-elements cause denial of service. This issue has been patched in version 0.33.0.
Metrics
Affected Vendors & Products
No data.
No data.
No data.
No data.
Advisories
No advisories yet.
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
History
Wed, 11 Nov 2026 22:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | fulgur converts untrusted HTML/CSS into PDF, commonly on a server that processes input supplied by many tenants. From version 0.6.0 to before version 0.33.0, quadratic style-list reprocessing during containing-block resolution for absolutely-positioned pseudo-elements cause denial of service. This issue has been patched in version 0.33.0. | |
| Title | fulgur: Quadratic style-list reprocessing during containing-block resolution for absolutely-positioned pseudo-elements causes denial of servicefulgur: | |
| Weaknesses | CWE-400 CWE-405 |
|
| References |
| |
| Metrics |
cvssV3_1
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: GitHub_M
Published:
Updated: 2026-11-11T22:12:33.400Z
Reserved: 2026-07-30T19:56:44.101Z
Link: CVE-2026-68540
Vulnrichment
No data.
NVD
Status : Deferred
Published: 2026-11-11T22:17:30.677
Modified: 2026-11-11T22:17:30.830
Link: CVE-2026-68540
Redhat
No data.
OpenCVE Enrichment
No data.