Cloud Vulnerability DB
A community-led vulnerabilities database
Register for the AI for Security Summit: Join Figma, Perplexity & Wiz
Vulnerability DatabaseCVE-2026-68523
CVE-2026-68523:
Rust vulnerability analysis and mitigation
Overview
CVE-2026-68523 is a denial-of-service vulnerability in fulgur, a Rust crate that converts untrusted HTML/CSS into PDF. In versions prior to 0.19.0, a body-direct child element whose CSS-resolved height greatly exceeds the page height is sliced into one fragment per page with no upper bound, enabling CPU and memory exhaustion via a trivially small payload. A non-finite height (resolving to +inf) additionally causes an infinite loop in the pagination code. The vulnerability affects all fulgur (fulgur-rs) releases before 0.19.0 and carries a CVSS v3.1 base score of 7.5 (High) (GitHub Advisory, GHSA).
Technical details
The root cause is twofold: uncontrolled resource consumption (CWE-400) and a loop with an unreachable exit condition (CWE-835). In pagination_layout.rs, the page-slicing loop for body-direct children derives child_h directly from attacker-controlled CSS properties (height, vh units) without any upper bound on the resulting page count. A payload such as a <div> with height:99999999px forces approximately 125,000 page fragments; downstream code in render.rs then allocates vec![Vec::new(); page_count] and runs a per-page render loop, exhausting CPU and memory. When the CSS height resolves to +inf (e.g., via certain non-finite values), the decrement remaining -= last_slice_h never converges, producing a true infinite loop. A secondary attack path exists via position:absolute elements with large top offsets, which can similarly drive page counts into the hundreds of thousands through append_position_absolute_body_direct_fragments (GitHub Advisory, Fix PR #501).
Impact
Successful exploitation causes complete availability loss for the affected fulgur-based conversion service through CPU and memory exhaustion. Because fulgur is commonly deployed as a multi-tenant server-side PDF rendering service, a single attacker-controlled HTML submission can deny service to all co-tenants on the same host. There is no confidentiality or integrity impact; the vulnerability is purely an availability issue (GitHub Advisory).
Exploitability
No public proof-of-concept exploit code or in-the-wild exploitation has been reported. The EPSS score is 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. However, exploitation requires no authentication, no user interaction, and only a few bytes of crafted HTML/CSS input, making it trivially easy for any tenant with HTML submission access to trigger (GitHub Advisory, Feedly).
Exploitation steps
- Identify target: Locate a network-accessible service that accepts untrusted HTML/CSS input and uses the
fulgurRust crate (version < 0.19.0) to render PDFs server-side. - Craft DoS payload: Construct a minimal HTML document with a body-direct child element whose CSS height is set to an extremely large value, for example:
Alternatively, use a non-finite height to trigger an infinite loop:<html><body><div style="height:99999999px"></div></body></html><html><body><div style="height:calc(infinity * 1px)"></div></body></html> - Submit payload: Send the crafted HTML to the service's PDF conversion endpoint via a standard HTTP request (no authentication required in the worst-case deployment).
- Trigger resource exhaustion: The pagination engine slices the tall element into ~125,000 page fragments;
render.rsallocates a vector of that size and enters a per-page render loop, consuming all available CPU and memory. - Achieve denial of service: The server becomes unresponsive, denying service to all co-tenants until the process is killed or the host is restarted (GitHub Advisory, Fix PR #501).
Indicators of compromise
- Process: The fulgur rendering process (or its parent application) consuming 100% CPU for an extended period with no corresponding legitimate workload; runaway memory allocation by the Rust process handling PDF conversion.
- Logs: Application logs showing PDF rendering requests that never complete or time out; log entries from fulgur 0.19.0+ showing
log::warn!messages about page count truncation (indicating a capped but attempted DoS payload). - Network: Repeated or single HTTP requests to the PDF conversion endpoint containing HTML bodies with extremely large
heightorvhCSS values on body-level elements; unusually small request payloads (a few bytes) associated with service hangs. - File System: Core dump files or OOM-killer logs (
/var/log/kern.log,dmesg) indicating the fulgur process was killed due to memory exhaustion.
Mitigation and workarounds
Upgrade fulgur to version 0.19.0 or later, which introduces a MAX_PAGES cap (set to 100,000) that bounds the page-slicing loop even for +inf heights, and sanitizes non-finite layout heights to 0.0 so they cannot drive the loop. If an immediate upgrade is not possible, validate or constrain untrusted CSS before passing HTML to fulgur — specifically, reject or clamp height and vh values on body-level elements to reasonable page-proportional limits. The absolute-positioning attack path (large top offsets) is also fixed in 0.19.0 by clamping first_page/last_page in the page-extension branch (GitHub Advisory, Fix PR #501).
Additional resources
Source: This report was generated using AI
Related Rust vulnerabilities:
Free Vulnerability Assessment
Benchmark your Cloud Security Posture
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Additional Wiz resources
Get a personalized demo
Ready to see Wiz in action?
"Best User Experience I have ever seen, provides full visibility to cloud workloads."
David EstlickCISO
"Wiz provides a single pane of glass to see what is going on in our cloud environments."
Adam FletcherChief Security Officer
"We know that if Wiz identifies something as critical, it actually is."
Greg PoniatowskiHead of Threat and Vulnerability Management