RUSTSEC-2026-0201: fulgur PDF Generation Denial of Service

RUSTSEC-2026-0201 Vulnerability Overview Vulnerability Name: Non-painting replaced elements amplify to thousands of blank PDF pages (denial of service) Reported Date: July 5, 2026 Published Date: July 4, 2026 Affected Package: fulgur (crates.io) Vulnerability Type: Vulnerability Classification: denial-of-service Keywords: #dos #pagination #pdf Alias: GHSA-4rf6-qx84-q9fv Reference Link: GitHub Advisory CVSS Score: 7.5 CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Patched Version: >=0.26.0 Impact Scope Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality Impact: None Integrity Impact: None Availability Impact: High Remediation Patched Version: >=0.26.0 Description: - Prior to version 0.26.0, a box with no child elements could expand to produce thousands of blank PDF pages, resulting in a denial of service. - Fix: Removed the label-only gate, allowing any pathologically tall child element box to collapse correctly, regardless of whether it is a replaced element. - Closed missing , , undecodable formats, empty vectors, and trailing sibling variants. - Prior to version 0.19.0, there was also a missing page count limit, allowing unlimited (over 10,000 pages) variants; this early variant is tracked separately as GHSA-j5cx-ph8g-95v3. Attack Vector Rationale fulgur: Does not perform network I/O itself; it renders HTML/CSS via embedding in applications. Therefore, the Attack Vector in the CVSS v3.1 User Guide §3.7 is assessed as "Network," applicable to a reasonable worst-case deployment—a network service rendering untrusted HTML without user interaction. A specific system that receives HTML and passes it to fulgur in a separate component might assess a lower environmental Attack Vector (Local, per $3.10). License This advisory is available under the CC0-1.0 license.

Goal Reached Thanks to every supporter — we hit 100%!

RUSTSEC-2026-0201: fulgur PDF Generation Denial of Service