CVE-2026-68537 in fulgur
Summary
by MITRE • 09/18/2026
`fulgur` converts untrusted HTML/CSS into PDF, commonly on a server that processes input supplied by many tenants. In versions prior to 0.19.0, a body-direct child whose CSS-resolved height greatly exceeds the page height was sliced into one fragment per page with no upper bound. This is fixed in version 0.19.0. A `MAX_PAGES` cap bounds the slice loop — halting it even for a `+inf` height — and non-finite layout heights are sanitized so they can no longer drive the loop. As a workaround, validate or constrain untrusted CSS (in particular `height` / `vh` on body-level elements) before passing HTML to fulgur.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/18/2026
The vulnerability identified in the fulgur library prior to version 0.19.0 represents a significant resource exhaustion risk for applications that process untrusted content, particularly those operating as multi-tenant services or public-facing PDF generation endpoints. Fulgur is designed to convert HTML and CSS documents into PDF format, a function often utilized by servers handling inputs from numerous distinct users. The core issue stems from the library's internal pagination logic when encountering specific structural anomalies in the input document. Specifically, if an element directly under the body tag possesses a computed height that resolves to a value significantly larger than the physical page dimensions, or specifically infinite values such as plus infinity, the rendering engine attempts to slice this content into fragments corresponding to each potential page.
In affected versions, there was no upper limit imposed on the number of pages generated from a single element. This lack of constraint allows an attacker to craft malicious HTML input where a body-direct child has its height set via CSS properties like explicit pixel values or viewport height units that resolve to extreme magnitudes. When such input is processed by fulgur, the slicing loop iterates without termination for practical purposes, consuming increasing amounts of CPU cycles and memory with each generated page fragment. This behavior constitutes a classic Denial of Service scenario, where a single request can exhaust server resources, leading to service unavailability for all other tenants sharing that infrastructure. The vulnerability is categorized under CWE-400, which describes Uncontrolled Resource Consumption, as the application fails to properly limit the amount of computational or storage resources consumed by an external input.
The operational impact of this flaw extends beyond simple performance degradation. In a multi-tenant environment, one malicious user could effectively block access for all other users by triggering this infinite loop condition. This not only disrupts business continuity but also increases infrastructure costs due to the excessive resource usage required to process the malformed request until system limits are hit or the service crashes entirely. The attack vector is straightforward and does not require authentication if the PDF generation endpoint accepts unvalidated HTML input, making it a high-risk vulnerability for web applications relying on this library for document creation features.
This issue was addressed in version 0.19.0 of fulgur through two primary technical measures. First, a maximum page count cap, referred to as MAX_PAGES, was introduced to bound the slicing loop. This ensures that even if an element has an infinite or excessively large height, the engine will stop generating pages after reaching this predefined limit, thereby preventing unbounded resource consumption. Second, non-finite layout heights are now sanitized during the parsing phase. By detecting and neutralizing values such as infinity before they can drive the pagination logic, the library ensures that only valid, finite dimensions contribute to page calculation. These changes effectively mitigate the risk of infinite loops caused by malformed CSS height properties on body-level elements.
To maintain security posture while using this or similar libraries, organizations should implement defense-in-depth strategies. The primary mitigation is upgrading to version 0.19.0 or later where these bounds are enforced natively. However, relying solely on library updates may not be sufficient if other components in the pipeline remain vulnerable. Therefore, it is critical to validate and constrain untrusted CSS inputs before they reach the rendering engine. Specifically, developers should sanitize height properties, particularly those using viewport units like vh or absolute pixel values, ensuring they fall within reasonable bounds expected for standard document layouts. Additionally, integrating web application firewalls that can detect patterns indicative of resource exhaustion attacks may provide an additional layer of protection against such abuse vectors aligned with ATT&CK techniques related to impact and denial of service.