{"id":"EUVD-2026-82425","enisaUuid":"1bec9e98-2d2d-33f4-80b9-9ef4a4d2a449","description":"`fulgur` converts untrusted HTML/CSS into PDF, commonly on a server that processes input supplied by many tenants. In versions prior to 0.19.0, a body-direct child whose CSS-resolved height greatly exceeds the page height was sliced into one fragment per page with no upper bound. This is fixed in version 0.19.0. A `MAX_PAGES` cap bounds the slice loop — halting it even for a `+inf` height — and non-finite layout heights are sanitized so they can no longer drive the loop. As a workaround, validate or constrain untrusted CSS (in particular `height` / `vh` on body-level elements) before passing HTML to fulgur.","datePublished":"Sep 17, 2026, 8:18:59 PM","dateUpdated":"Sep 17, 2026, 8:23:12 PM","baseScore":7.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","references":"https://github.com/fulgur-rs/fulgur/security/advisories/GHSA-4rf6-qx84-q9fv\nhttps://github.com/fulgur-rs/fulgur/pull/501\nhttps://rustsec.org/advisories/RUSTSEC-2026-0200.html\n","aliases":"CVE-2026-68537\nGHSA-4rf6-qx84-q9fv\n","assigner":"GitHub_M","epss":0.61,"enisaIdProduct":[{"id":"35244342-9696-3e81-b388-6fa730f8a8f3","product":{"name":"fulgur","vendor":{"name":"fulgur-rs"}},"product_version":"\u003c 0.19.0"}],"enisaIdVendor":[{"id":"dae0f260-0afc-341e-8f82-b84fa24caacf","vendor":{"name":"fulgur-rs"}}],"enisaIdVulnerability":[{"id":"9f4aa33c-ecc6-3dab-9711-d6db40dbb8ce","vulnerability":{"id":"CVE-2026-68537","description":"`fulgur` converts untrusted HTML/CSS into PDF, commonly on a server that processes input supplied by many tenants. In versions prior to 0.19.0, a body-direct child whose CSS-resolved height greatly exceeds the page height was sliced into one fragment per page with no upper bound. This is fixed in version 0.19.0. A `MAX_PAGES` cap bounds the slice loop — halting it even for a `+inf` height — and non-finite layout heights are sanitized so they can no longer drive the loop. As a workaround, validate or constrain untrusted CSS (in particular `height` / `vh` on body-level elements) before passing HTML to fulgur.","datePublished":"Sep 17, 2026, 8:18:59 PM","dateUpdated":"Sep 17, 2026, 8:23:12 PM","status":"PUBLISHED","baseScore":7.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","references":"https://github.com/fulgur-rs/fulgur/security/advisories/GHSA-4rf6-qx84-q9fv\nhttps://github.com/fulgur-rs/fulgur/pull/501\nhttps://rustsec.org/advisories/RUSTSEC-2026-0200.html\n","enisa_id":"EUVD-2026-82425\n","assigner":"GitHub_M","epss":0.61,"dataProcessed":"Nov 1, 2026, 7:17:18 AM","vulnerabilityProduct":[{"id":"11a7bb11-fe06-30f3-aff8-76673c2afc3e","product":{"name":"fulgur","vendor":{"name":"fulgur-rs"}},"product_version":"\u003c 0.19.0"}],"vulnerabilityVendor":[{"id":"55226ad6-a95b-3a6a-9df9-d54888aed6cf","vendor":{"name":"fulgur-rs"}}]}},{"id":"c469f621-940f-3a9a-8b22-4502d7cc63e9","vulnerability":{"id":"GHSA-4rf6-qx84-q9fv","description":"Fulgur: Non-painting replaced elements amplify to thousands of blank PDF pages (denial of service)","datePublished":"Sep 17, 2026, 6:49:15 PM","dateUpdated":"Sep 17, 2026, 6:49:15 PM","baseScore":0.0,"references":"https://github.com/fulgur-rs/fulgur/security/advisories/GHSA-4rf6-qx84-q9fv\nhttps://github.com/fulgur-rs/fulgur/pull/575\nhttps://github.com/fulgur-rs/fulgur\nhttps://rustsec.org/advisories/RUSTSEC-2026-0201.html\n","enisa_id":"EUVD-2026-82425\n","aliases":"GHSA-4rf6-qx84-q9fv\nCVE-2026-68537\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:06:27 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}