CVE-2026-68523 is a high-severity (CVSS 7.5) Uncontrolled Resource Consumption vulnerability in fulgur. A fix is available for fulgur — see the affected versions and patch details below.
Fulgur: Unbounded page slicing from attacker-controlled CSS height causes denial of service
Real-World Exposure
fulgurReal-time download stats are indexed for npm and PyPI packages. This vulnerability affects crates.io packages — download data is not available via public APIs for these ecosystems.
Description
fulgur converts untrusted HTML/CSS into PDF, commonly on a server that
processes input supplied by many tenants. In versions prior to 0.19.0, a
body-direct child whose CSS-resolved height greatly exceeds the page height was
sliced into one fragment per page with no upper bound.
The height is taken directly from attacker-controlled HTML/CSS (height, vh
units), so a few bytes such as:
<div style="height:99999999px"></div>
forced on the order of 125,000 page fragments. The pagination code then
allocates vec![Vec::new(); page_count] and runs a per-page render loop,
resulting in CPU and memory exhaustion. A non-finite height (one that resolves
to +inf) additionally made the slicing loop's remaining -= last_slice_h
decrement never terminate, causing an infinite loop.
An attacker able to submit HTML/CSS to a fulgur-based conversion service can trigger this with a trivially small payload, denying service to the host and any co-tenants.
Patches
Fixed in 0.19.0. A MAX_PAGES cap bounds the slice loop — halting it even
for a +inf height — and non-finite layout heights are sanitized so they can no
longer drive the loop.
Workarounds
Upgrade to 0.19.0 or later. If upgrading is not immediately possible, validate
or constrain untrusted CSS (in particular height / vh on body-level
elements) before passing HTML to fulgur.
Attack Vector rationale
fulgur performs no network I/O of its own; it renders HTML/CSS handed to it by
the embedding application. This advisory scores the crate independent of any
specific adopting program, so per the CVSS v3.1 User Guide §3.7 (scoring library
vulnerabilities related to incoming data) the Attack Vector is assessed as
Network for the reasonable worst-case deployment — a network-facing service
that renders untrusted, attacker-supplied HTML without user interaction. A
concrete system that receives the HTML in one component and passes it to fulgur
in a separate component may assess a lower environmental Attack Vector (Local,
per §3.10).
References
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 🦀crates.io | fulgur | all versions | 0.19.0cargo update -p fulgur --precise 0.19.0 |
Detection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for fulgur, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update fulgur to 0.19.0 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2026-68523 is resolved across your whole dependency graph.
Workarounds
If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.
How O3 protects you
O3 Security's impact-aware SCA analyses which vulnerable code paths your application actually calls, so a match like CVE-2026-68523 can be triaged on real exposure rather than presence alone.
Tailored to CVE-2026-68523. Runtime protection reduces exposure until a permanent patch is applied and verified — it complements patching, it doesn't replace it.
Frequently Asked Questions
Is CVE-2026-68523 in your dependencies?
O3 Security finds CVE-2026-68523 across crates.io dependencies, including transitive ones, and its impact-aware SCA ranks findings by whether your code actually calls the vulnerable path.