Fulgur: Non-painting replaced elements amplify to thousands of blank PDF pages (denial of service)

`fulgur` converts untrusted HTML/CSS into PDF, commonly on a server that processes input supplied by many tenants. In versions prior to 0.26.0, a childless box that resolves to a pathologically tall height was amplified into thousands of blank PDF pages, even when it produces no visible output. The childless-collapse defense that would normally collapse such a box was gated by a tag-only "replaced content" check, so any **non-painting replaced element** bypassed it, including: - an unresolved `src` (the common offline-first case), - a `visibility:hidden` image, - an undecodable image format, and - an empty `<svg>`. A trailing-sibling variant of the same gap was also open. A few bytes of HTML therefore amplified into roughly `MAX_PAGES` (10,000) blank pages; the renderer allocates and runs a per-page loop over them, producing CPU and memory exhaustion. An attacker able to submit HTML to a fulgur-based conversion service can trigger this with a trivially small payload, denying service to the host and any co-tenants. ## Patches Fixed in **0.26.0** (PR #575). The tag-only gate was removed so that any pathologically tall childless box collapses regardless of whether it is a replaced element, closing the missing-`src`, `visibility:hidden`, undecodable-format, and empty-`<svg>` vectors at once, along with the trailing-sibling variant. ## Workarounds Upgrade to 0.26.0 or later. If upgrading is not immediately possible, validate or constrain untrusted CSS (in particular very large `height` / `vh` on elements) before passing HTML to fulgur. ## Related Versions prior to 0.19.0 additionally lacked any page-count cap, allowing an unbounded (rather than 10,000-page) variant of this amplification and a non-terminating loop on non-finite heights. That earlier variant is tracked separately as GHSA-j5cx-ph8g-95v3. ## Attack Vector rationale `fulgur` performs no network I/O of its own; it renders HTML/CSS handed to it by the embedding application. This advisory scores the crate independent of any specific adopting program, so per the CVSS v3.1 User Guide §3.7 (scoring library vulnerabilities related to incoming data) the Attack Vector is assessed as **Network** for the reasonable worst-case deployment — a network-facing service that renders untrusted, attacker-supplied HTML without user interaction. A concrete system that receives the HTML in one component and passes it to fulgur in a separate component may assess a lower environmental Attack Vector (Local, per §3.10). ## References - Fix: https://github.com/fulgur-rs/fulgur/pull/575

Source published

17 Sep 2026 18:49:15 UTC

Source modified

17 Sep 2026 19:10:53 UTC

Observed here

24 Oct 2026 13:19:54 UTC

Source terms

GitHub Advisory Database · CC-BY-4.0

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: osv · GitHub Advisory Database · CC-BY-4.0. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS_V3 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Publisher rating · HIGH