CVE-2026-68539

CVSS 7.5 (high) · published 2026-11-11

fulgur converts untrusted HTML/CSS into PDF, commonly on a server that processes input supplied by many tenants. From version 0.4.4 to before version 0.29.0, the CSS string-set named-string values resolved from a document were accumulated per element with no memory budget, letting a small crafted document amplify into large retained memory (and the CPU to copy it) — results in a denial of service. This issue has been patched in version 0.29.0.

Weakness: CWE-400, CWE-770

Source: NVD CVE-2026-68539

References

• https://github.com/fulgur-rs/fulgur/commit/1c4cdad003daef7c9dc6ef1362c50bcfaac13ea9
• https://github.com/fulgur-rs/fulgur/commit/9248fbfd91a2ba8fc3dbd9e44ba681f52ed1ecd0
• https://github.com/fulgur-rs/fulgur/pull/582
• https://github.com/fulgur-rs/fulgur/pull/584
• https://github.com/fulgur-rs/fulgur/releases/tag/v0.29.0
• https://github.com/fulgur-rs/fulgur/security/advisories/GHSA-vw2v-g4x7-xcqg

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.