Cloud Vulnerability DB
A community-led vulnerabilities database
Register for the AI for Security Summit: Join Figma, Perplexity & Wiz
Vulnerability DatabaseCVE-2026-68537
CVE-2026-68537:
Rust vulnerability analysis and mitigation
Overview
CVE-2026-68537 is a Denial of Service (DoS) vulnerability in fulgur, a Rust library that converts untrusted HTML/CSS into PDF. In versions prior to 0.26.0, a childless HTML element resolving to a pathologically tall CSS height could bypass the library's collapse defense (due to a tag-only "replaced content" check) and be amplified into approximately 10,000 blank PDF pages, causing CPU and memory exhaustion. The vulnerability affects all fulgur versions before 0.26.0 and was published on July 4, 2026, with the GitHub Advisory Database entry updated on September 17, 2026. It carries a CVSS v3.1 base score of 7.5 (High) (Github Advisory).
Technical details
The root cause is classified as CWE-400 (Uncontrolled Resource Consumption) and CWE-835 (Loop with Unreachable Exit Condition). In pagination_layout.rs, the childless-collapse defense was gated by a tag-name-only is_replaced_content() check, which excluded <img> and <svg> elements from collapsing regardless of whether they actually rendered any content. This meant non-painting replaced elements — including those with an unresolved src, visibility:hidden, an undecodable image format, or an empty <svg> — bypassed the collapse logic entirely. A few bytes of HTML (e.g., <img style="height:99999999px">) caused the renderer to allocate vec![Vec::new(); page_count] and run a per-page render loop over ~10,000 pages, exhausting CPU and memory. Additionally, a non-finite height (+inf) could cause the slice loop's remaining -= last_slice_h to never terminate, creating a true infinite loop. A trailing-sibling variant was also present, where content following the tall element was stranded on a deep page, re-inflating the PDF even after partial fixes (Github Advisory, PR #575, PR #501).
Impact
Successful exploitation results in complete availability loss for the affected fulgur-based service, with no impact on confidentiality or integrity. An attacker submitting a trivially small HTML payload (a few bytes) to any network-facing service that passes untrusted HTML to fulgur can trigger CPU and memory exhaustion, denying service to the host and all co-tenants sharing the same conversion service. In multi-tenant environments, this amplification attack is particularly severe as a single malicious request can degrade or crash the service for all users (Github Advisory).
Exploitability
No public proof-of-concept exploit code or in-the-wild exploitation has been reported. The vulnerability is rated as automatable (no user interaction required, low attack complexity, no privileges required), making it trivially exploitable by any attacker who can submit HTML to a fulgur-based conversion service. The EPSS score is 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. NVD SSVC assessment classifies exploitation as "none" at this time (Github Advisory).
Exploitation steps
- Identify target: Locate a network-facing service that accepts untrusted HTML/CSS input and uses the
fulgurRust crate (versions < 0.26.0) for HTML-to-PDF conversion. - Craft malicious payload: Construct a minimal HTML document containing a non-painting replaced element with a pathologically large CSS height, such as
<html><body><img src="missing.png" style="height:99999999px"></body></html>(a few bytes of input). - Submit payload: Send the crafted HTML to the conversion service endpoint via an HTTP request or any other supported input channel.
- Trigger amplification: The fulgur renderer, failing to collapse the non-painting replaced element, slices it into ~10,000 blank PDF pages, allocating memory and running a per-page render loop for each — exhausting CPU and memory on the server.
- Sustain DoS: Repeat submissions (or use a single request with a
+infheight to trigger a potential infinite loop in versions < 0.19.0) to maintain denial of service for the host and co-tenants (Github Advisory, PR #575).
Indicators of compromise
- Network: Repeated HTTP requests to the HTML-to-PDF conversion endpoint with small payloads (a few bytes of HTML) that result in unusually long processing times or server errors.
- Process: Abnormally high CPU and memory utilization by the fulgur-based service process, potentially leading to OOM kills or process crashes.
- Logs: Application logs showing PDF generation jobs that take an unexpectedly long time or fail with memory allocation errors; log entries from fulgur's
log::warn!indicating page count truncation atMAX_PAGES(in patched versions ≥ 0.19.0). - File System: Generation of abnormally large PDF output files (e.g., multi-megabyte files for trivially small HTML inputs) or a high volume of temporary files associated with PDF rendering.
Mitigation and workarounds
Upgrade fulgur to version 0.26.0 or later, which removes the tag-only is_replaced_content() gate so that any pathologically tall childless box collapses regardless of element type, closing all known attack vectors including missing src, visibility:hidden, undecodable formats, empty <svg>, and the trailing-sibling variant (Github Advisory, PR #575). Note that versions ≥ 0.19.0 and < 0.26.0 include a MAX_PAGES cap (introduced in PR #501) that bounds the amplification to ~10,000 pages rather than allowing an unbounded loop, but the non-painting replaced element bypass remains open in those versions. If immediate upgrade is not possible, validate or constrain untrusted CSS — particularly large height and vh values on body-level elements — before passing HTML to fulgur.
Community reactions
The vulnerability was originally discovered via a Codex security scan (automated AI-assisted code review) and reported to the fulgur maintainers. The fix was developed iteratively across multiple pull requests (#501, #553, #575), with AI code review tools (CodeRabbit, Gemini Code Assist, Codex) actively participating in identifying residual gaps such as the absolute-positioning path and the trailing-sibling variant. The advisory was published to the GitHub Advisory Database and RustSec advisory database, reflecting standard open-source security disclosure practices for the Rust ecosystem (Github Advisory, PR #575).
Additional resources
- Github Advisory — Official GitHub Security Advisory (GHSA-4rf6-qx84-q9fv)
- Security Advisory — fulgur-rs repository security advisory
- Fix PR #575 — Primary fix: collapse tall non-painting replaced elements
- Fix PR #501 — Initial fix: MAX_PAGES cap for unbounded page slicing
- RustSec Advisory — RustSec advisory database entry
Source: This report was generated using AI
Related Rust vulnerabilities:
Free Vulnerability Assessment
Benchmark your Cloud Security Posture
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Additional Wiz resources
Get a personalized demo
Ready to see Wiz in action?
"Best User Experience I have ever seen, provides full visibility to cloud workloads."
David EstlickCISO
"Wiz provides a single pane of glass to see what is going on in our cloud environments."
Adam FletcherChief Security Officer
"We know that if Wiz identifies something as critical, it actually is."
Greg PoniatowskiHead of Threat and Vulnerability Management