{"id":"EUVD-2026-82432","enisaUuid":"640cae74-ab4e-30b4-9317-64bede3c0135","description":"`fulgur` converts untrusted HTML/CSS into PDF, commonly on a server that processes input supplied by many tenants. In versions prior to 0.19.0, a body-direct child whose CSS-resolved height greatly exceeds the page height was sliced into one fragment per page with no upper bound. This is fixed in 0.19.0. A `MAX_PAGES` cap bounds the slice loop — halting it even\nfor a `+inf` height — and non-finite layout heights are sanitized so they can no longer drive the loop. As a workaround, validate or constrain untrusted CSS (in particular `height` / `vh` on body-level elements) before passing HTML to fulgur.","datePublished":"Sep 17, 2026, 8:23:23 PM","dateUpdated":"Sep 21, 2026, 9:16:02 PM","baseScore":7.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","references":"https://github.com/fulgur-rs/fulgur/security/advisories/GHSA-j5cx-ph8g-95v3\nhttps://github.com/fulgur-rs/fulgur/pull/501\nhttps://rustsec.org/advisories/RUSTSEC-2026-0200.html\n","aliases":"CVE-2026-68523\nGHSA-j5cx-ph8g-95v3\n","assigner":"GitHub_M","epss":0.61,"enisaIdProduct":[{"id":"c11aee7e-a8a3-3102-92f6-ee105737d1fb","product":{"name":"fulgur","vendor":{"name":"fulgur-rs"}},"product_version":"\u003c 0.19.0"}],"enisaIdVendor":[{"id":"fee96f63-83d9-31e7-b949-a57e18d3ec55","vendor":{"name":"fulgur-rs"}}],"enisaIdVulnerability":[{"id":"c238b7e3-3615-32f9-a9f9-6fb27b490ca5","vulnerability":{"id":"CVE-2026-68523","description":"`fulgur` converts untrusted HTML/CSS into PDF, commonly on a server that processes input supplied by many tenants. In versions prior to 0.19.0, a body-direct child whose CSS-resolved height greatly exceeds the page height was sliced into one fragment per page with no upper bound. This is fixed in 0.19.0. A `MAX_PAGES` cap bounds the slice loop — halting it even\nfor a `+inf` height — and non-finite layout heights are sanitized so they can no longer drive the loop. As a workaround, validate or constrain untrusted CSS (in particular `height` / `vh` on body-level elements) before passing HTML to fulgur.","datePublished":"Sep 17, 2026, 8:23:23 PM","dateUpdated":"Sep 21, 2026, 9:16:02 PM","status":"PUBLISHED","baseScore":7.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","references":"https://github.com/fulgur-rs/fulgur/security/advisories/GHSA-j5cx-ph8g-95v3\nhttps://github.com/fulgur-rs/fulgur/pull/501\nhttps://rustsec.org/advisories/RUSTSEC-2026-0200.html\n","enisa_id":"EUVD-2026-82432\n","assigner":"GitHub_M","epss":0.61,"dataProcessed":"Nov 3, 2026, 7:16:31 AM","vulnerabilityProduct":[{"id":"92b7488b-9186-35d1-a448-e0a18941ddde","product":{"name":"fulgur","vendor":{"name":"fulgur-rs"}},"product_version":"\u003c 0.19.0"}],"vulnerabilityVendor":[{"id":"c54b51a0-d6c6-3c97-8c5e-4dcb935ec5c1","vendor":{"name":"fulgur-rs"}}]}},{"id":"fb047156-d52a-310e-9aed-e92299d7af5b","vulnerability":{"id":"GHSA-j5cx-ph8g-95v3","description":"Fulgur: Unbounded page slicing from attacker-controlled CSS height causes denial of service","datePublished":"Sep 17, 2026, 6:48:55 PM","dateUpdated":"Sep 17, 2026, 6:48:55 PM","baseScore":0.0,"references":"https://github.com/fulgur-rs/fulgur/security/advisories/GHSA-j5cx-ph8g-95v3\nhttps://github.com/fulgur-rs/fulgur/pull/501\nhttps://github.com/fulgur-rs/fulgur\nhttps://rustsec.org/advisories/RUSTSEC-2026-0200.html\n","enisa_id":"EUVD-2026-82432\n","aliases":"GHSA-j5cx-ph8g-95v3\nCVE-2026-68523\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:06:27 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}