CVE-2026-68523 in fulgur
Summary
by MITRE • 09/18/2026
`fulgur` converts untrusted HTML/CSS into PDF, commonly on a server that processes input supplied by many tenants. In versions prior to 0.19.0, a body-direct child whose CSS-resolved height greatly exceeds the page height was sliced into one fragment per page with no upper bound. This is fixed in 0.19.0. A `MAX_PAGES` cap bounds the slice loop — halting it even for a `+inf` height — and non-finite layout heights are sanitized so they can no longer drive the loop. As a workaround, validate or constrain untrusted CSS (in particular `height` / `vh` on body-level elements) before passing HTML to fulgur.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/18/2026
The vulnerability identified in the fulgur library prior to version 0.19.0 represents a significant resource exhaustion risk within server-side PDF generation services that process untrusted input from multiple tenants. Fulgur is designed to convert HTML and CSS content into PDF documents, a function commonly deployed in environments where the underlying server handles requests originating from various independent users or applications. In this multi-tenant context, ensuring that processing resources remain bounded for any single request is critical to maintaining service availability for all connected parties. The specific flaw lies in how the library handles layout calculations when encountering CSS-resolved heights on body-direct children that exceed the standard page height by a large margin.
Technically, the vulnerability stems from an unbounded iteration loop within the PDF slicing mechanism. When fulgur processes HTML content where the resolved height of a direct child element is significantly larger than the physical dimensions of a single PDF page, it attempts to fragment this content across multiple pages. In versions prior to 0.19.0, there was no upper limit on the number of fragments or pages generated during this process. If an attacker supplies HTML with CSS properties such as height set to infinity or extremely large values using units like viewport heights (vh), the slicing loop continues indefinitely without a termination condition based on page count limits. This lack of constraint allows for infinite resource consumption, specifically targeting CPU cycles and memory allocation required to render each additional fragment.
The operational impact of this flaw is severe in production environments relying on fulgur for document generation. An attacker can exploit this behavior by submitting specially crafted HTML payloads that trigger the unbounded slicing loop. Because the server must process every generated page before returning or storing the final PDF, a single malicious request can consume all available processing power and memory associated with the worker handling that request. This constitutes a classic Denial of Service (DoS) vector, potentially causing service outages for legitimate users sharing the same infrastructure. The attack is particularly dangerous because it does not require authentication if the HTML input source is publicly accessible or if session validation can be bypassed through other means.
From a classification perspective, this vulnerability aligns with CWE-400, which describes Uncontrolled Resource Consumption, and specifically relates to scenarios where an attacker can cause a system to allocate excessive resources leading to service degradation. In the context of the MITRE ATT&CK framework, this behavior is consistent with T1496, Resource Hijacking, as it involves using legitimate software functions in a way that consumes disproportionate amounts of computational resources. The root cause is categorized under CWE-835, Loop with Unreachable Exit Condition, due to the absence of a proper boundary check on the iteration variable governing page generation.
The issue was addressed in fulgur version 0.19.0 through two primary technical controls. First, a MAX_PAGES cap was introduced to bound the slicing loop, ensuring that even if CSS resolves to an infinite height, the process halts after generating a predefined maximum number of pages. Second, non-finite layout heights are now sanitized before being processed by the rendering engine, preventing them from driving the page generation logic in an uncontrolled manner. These changes effectively neutralize the ability of malicious inputs to trigger infinite loops or excessive resource allocation during PDF creation.
To mitigate this risk for systems still running older versions or as a defense-in-depth measure, developers should implement strict validation and sanitization of CSS properties before passing HTML content to fulgur. Specifically, constraints should be applied to height values on body-level elements, rejecting inputs that specify infinite heights or excessively large viewport-based units like vh. Input validation at the application layer serves as an essential complement to library updates, ensuring that untrusted data is normalized and bounded prior to reaching the rendering engine. Regularly updating dependencies to incorporate these security patches remains the most effective long-term strategy for maintaining system integrity in multi-tenant PDF generation services.