CVE-2026-68523
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk47th percentile - higher than 47% of all known CVEs
Summary
fulgur, a tool converting untrusted HTML/CSS to PDF, prior to version 0.19.0 sliced a body-direct child whose CSS-resolved height greatly exceeds the page height into one fragment per page with no upper bound. This can lead to excessive resource consumption or process hang.
Risk Assessment
An attacker can supply malicious HTML/CSS, causing memory or CPU exhaustion and denial of service on a server processing input from many tenants. This affects service availability for all users.
Recommendation
Upgrade fulgur to version 0.19.0 or later. As a workaround, validate or constrain untrusted CSS (in particular height / vh on body-level elements) before passing HTML to fulgur.
Other vulnerabilities in fulgur
Original NVD description (English source)
`fulgur` converts untrusted HTML/CSS into PDF, commonly on a server that processes input supplied by many tenants. In versions prior to 0.19.0, a body-direct child whose CSS-resolved height greatly exceeds the page height was sliced into one fragment per page with no upper bound. This is fixed in 0.19.0. A `MAX_PAGES` cap bounds the slice loop — halting it even for a `+inf` height — and non-finite layout heights are sanitized so they can no longer drive the loop. As a workaround, validate or constrain untrusted CSS (in particular `height` / `vh` on body-level elements) before passing HTML to fulgur.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS