High severity7.5NVD Advisory· Published Nov 11, 2026· Updated Nov 11, 2026
CVE-2026-68539
CVE-2026-68539
Description
fulgur converts untrusted HTML/CSS into PDF, commonly on a server that processes input supplied by many tenants. From version 0.4.4 to before version 0.29.0, the CSS string-set named-string values resolved from a document were accumulated per element with no memory budget, letting a small crafted document amplify into large retained memory (and the CPU to copy it) — results in a denial of service. This issue has been patched in version 0.29.0.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
2Patches
Vulnerability mechanics
References
6- github.com/fulgur-rs/fulgur/commit/1c4cdad003daef7c9dc6ef1362c50bcfaac13ea9nvd
- github.com/fulgur-rs/fulgur/commit/9248fbfd91a2ba8fc3dbd9e44ba681f52ed1ecd0nvd
- github.com/fulgur-rs/fulgur/pull/582nvd
- github.com/fulgur-rs/fulgur/pull/584nvd
- github.com/fulgur-rs/fulgur/releases/tag/v0.29.0nvd
- github.com/fulgur-rs/fulgur/security/advisories/GHSA-vw2v-g4x7-xcqgnvd
News mentions
0No linked articles in our index yet.