{"id":"CVE-2026-68539","summary":"fulgur: Unbounded string-set value accumulation causes memory/CPU exhaustion (denial of service)","details":"fulgur converts untrusted HTML/CSS into PDF, commonly on a server that processes input supplied by many tenants. From version 0.4.4 to before version 0.29.0, the CSS string-set named-string values resolved from a document were accumulated per element with no memory budget, letting a small crafted document amplify into large retained memory (and the CPU to copy it) — results in a denial of service. This issue has been patched in version 0.29.0.","aliases":["GHSA-vw2v-g4x7-xcqg"],"modified":"2026-11-13T02:47:36.581313226Z","published":"2026-11-11T22:12:18.353Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68539.json","cna_assigner":"GitHub_M","cwe_ids":["CWE-400","CWE-770"]},"references":[{"type":"WEB","url":"https://github.com/fulgur-rs/fulgur/releases/tag/v0.29.0"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68539.json"},{"type":"ADVISORY","url":"https://github.com/fulgur-rs/fulgur/security/advisories/GHSA-vw2v-g4x7-xcqg"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68539"},{"type":"FIX","url":"https://github.com/fulgur-rs/fulgur/commit/1c4cdad003daef7c9dc6ef1362c50bcfaac13ea9"},{"type":"FIX","url":"https://github.com/fulgur-rs/fulgur/commit/9248fbfd91a2ba8fc3dbd9e44ba681f52ed1ecd0"},{"type":"FIX","url":"https://github.com/fulgur-rs/fulgur/pull/582"},{"type":"FIX","url":"https://github.com/fulgur-rs/fulgur/pull/584"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/fulgur-rs/fulgur","events":[{"introduced":"5f5304b0e6b334a43aa3d20e64510cbc3e6d143c"},{"fixed":"2a8927e37937898e2cd38fa11f8687e28671f1ef"},{"fixed":"1c4cdad003daef7c9dc6ef1362c50bcfaac13ea9"},{"fixed":"9248fbfd91a2ba8fc3dbd9e44ba681f52ed1ecd0"}],"database_specific":{"extracted_events":[{"strategy":"StringRangeExpression","range":[{"introduced":"0.4.4"},{"fixed":"0.29.0"}],"source":"AFFECTED_FIELD"},{"source":"REFERENCES_COMMIT","range":[{"fixed":"1c4cdad003daef7c9dc6ef1362c50bcfaac13ea9"}]},{"range":[{"fixed":"9248fbfd91a2ba8fc3dbd9e44ba681f52ed1ecd0"}],"source":"REFERENCES_COMMIT"},{"original_tag":"v0.29.0","range":[{"fixed":"2a8927e37937898e2cd38fa11f8687e28671f1ef"}],"source":"REFERENCES_TAG"}]}}],"versions":["v0.20.0","v0.19.0","v0.18.0","v0.17.0","v0.16.0","v0.15.0","v0.14.0","v0.13.0","v0.12.0","v0.11.0","v0.10.0","v0.9.0","v0.8.0","v0.7.0","v0.6.0","v0.5.14","v0.5.13","v0.5.12","v0.5.11","v0.5.10","v0.5.9","v0.5.8","v0.5.7","v0.5.6","v0.5.5","v0.5.4","v0.5.2","v0.5.1","v0.5.0","v0.4.5","untagged-548e2812dc7f04b1078f","v0.4.4"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-68539.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}]}