CVE-2026-68539
fulgur converts untrusted HTML/CSS into PDF, commonly on a server that processes input supplied by many tenants. From version 0.4.4 to befor
CVSS
7.5
Alto
EPSS
—
KEV
—
Exploit Today
—
0-100
Publicado: 11 nov 2026 · Última mod.: 11 nov 2026 · CWE-400 · CWE-770
Sin historial EPSS suficiente todavía.
fulgur converts untrusted HTML/CSS into PDF, commonly on a server that processes input supplied by many tenants. From version 0.4.4 to before version 0.29.0, the CSS string-set named-string values resolved from a document were accumulated per element with no memory budget, letting a small crafted document amplify into large retained memory (and the CPU to copy it) — results in a denial of service. This issue has been patched in version 0.29.0.
- github.comhttps://github.com/fulgur-rs/fulgur/commit/1c4cdad003daef7c9dc6ef1362c50bcfaac13ea9
- github.comhttps://github.com/fulgur-rs/fulgur/commit/9248fbfd91a2ba8fc3dbd9e44ba681f52ed1ecd0
- github.comhttps://github.com/fulgur-rs/fulgur/pull/582
- github.comhttps://github.com/fulgur-rs/fulgur/pull/584
- github.comhttps://github.com/fulgur-rs/fulgur/releases/tag/v0.29.0
- github.comhttps://github.com/fulgur-rs/fulgur/security/advisories/GHSA-vw2v-g4x7-xcqg
CVECVSSEPSSKEVRExplotTítuloVis.
CVE-2026-685407.5 ALT—
———fulgur converts untrusted HTML/CSS into PDF, commonly on a server that processes input supplied by many tenants. From version 0.6.0 to before version 0.33.0, quadratic style-list reprocessing during containing-block resolution for absolutely-positioned pseudo-elements cause denial of service. This issue has been patched in version 0.33.0.3hCVE-2026-685387.5 ALT—
———fulgur converts untrusted HTML/CSS into PDF, commonly on a server that processes input supplied by many tenants. From version 0.15.0 to before version 0.27.0, resolving the CSS counters(name, sep) function in generated content was bounded neither in the size of a single expansion nor in the aggregate work across an element tree. An attacker able to submit HTML/CSS to a fulgur-based conversion service can trigger CPU and memory exhaustion with a trivially small payload, denying service to the host and any co-tenants. This issue has been patched in version 0.27.0.3hCVE-2026-1262447.5 ALT—
———A allocation of resources without limits or throttling vulnerability in Fortinet FortiAuthenticator 8.0.0 through 8.0.3, FortiAuthenticator 6.6.0 through 6.6.10 may allow an unauthenticated attacker to exhaust system resources, potentially resulting in a denial of service (DoS).3hCVE-2026-1261617.5 ALT—
———A uncontrolled resource consumption vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.6 may allow a remote unauthenticated attacker to cause a denial of service via repeated unauthenticated POST requests.3hCVE-2026-1267844.3 MED—
———Missing rate limiting, per-account submission quota and geographic validation in the publicar_aviso RPC function in Lagarto Chivato 0.4.1 and earlier on Web allows remote authenticated attackers to flood the moderation queue via unlimited submission of notices with arbitrary coordinates.5hCVE-2026-911507.5 ALT—
———A flaw was found in Cockpit. This vulnerability allows a remote attacker, without prior authentication, to send specially crafted fragmented WebSocket messages. These messages accumulate without a total-size limit, leading to unbounded memory exhaustion and a denial of service in the `cockpit-ws` service.6h