RUSTSEC-2026-0200: fulgur HTML/CSS to PDF Denial of Service Vulnerability

RUSTSEC-2026-0200 Vulnerability Overview Description: Unrestricted page slicing, where attacker-controlled CSS height can lead to a denial of service. CVSS Score: 7.5 CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Publication Date: 2026-07-05 Affected Versions: Patched Versions: Affected Scope Affected Package: (crates.io) Vulnerability Type: Vulnerability Classification: denial-of-service Keywords: , , Aliases: GHSA-j5cx-ph8g-95v3 Remediation Patched Versions: Fix Details: In version 0.19.0, the cap limits the slicing loop, ensuring it terminates even for heights. Additionally, non-finite layout heights are sanitized so they can no longer drive the loop. Detailed Description Vulnerability Principle: converts untrusted HTML/CSS into PDF, typically processing inputs from multiple tenants on a server. In versions prior to 0.19.0, when the CSS of body-direct child elements far exceeded the page height, pages were sliced without an upper limit, creating one segment per page. Attack Vector: Attacker-controlled HTML/CSS (using or units) can trigger this vulnerability. For example, forces pagination. The pagination code allocates and runs a rendering loop for each page, leading to CPU and memory exhaustion. Non-finite heights (parsed as ) cause the slicing loop's decrement to never terminate, resulting in an infinite loop. Attacker Capabilities: An attacker who can submit HTML/CSS to a conversion service based on fulgur can trigger this vulnerability, causing a denial of service for the host and any co-tenants. Remediation: In version 0.19.0, the cap limits the slicing loop, ensuring it terminates even for heights. Furthermore, non-finite layout heights are sanitized so they can no longer drive the loop. Attack Vector Justification Network I/O: itself does not perform network I/O; it renders HTML/CSS provided by the embedding application. Scoring Basis: This rating applies to the crate itself, independent of any specific implementation. Therefore, following the CVSS v3.1 User Guide §3.7, the Attack Vector is assessed as Network, applicable to a reasonable worst-case deployment—a network-facing service rendering untrusted HTML without requiring user interaction. A specific system that receives HTML and passes it to fulgur in a separate component might evaluate a lower Environmental Attack Vector (Local, see §3.10). References GitHub Security Advisory License This advisory is available under the CC0-1.0 license.

Goal Reached Thanks to every supporter — we hit 100%!

RUSTSEC-2026-0200: fulgur HTML/CSS to PDF Denial of Service Vulnerability