{"affected":[{"product":"fulgur","source":"CNA: GitHub_M","vendor":"fulgur-rs","versions":[{"status":"affected","version":">= 0.4.4, < 0.29.0"}]}],"cveId":"CVE-2026-68539","cwes":["CWE-400","CWE-770"],"description":"fulgur converts untrusted HTML/CSS into PDF, commonly on a server that processes input supplied by many tenants. From version 0.4.4 to before version 0.29.0, the CSS string-set named-string values resolved from a document were accumulated per element with no memory budget, letting a small crafted document amplify into large retained memory (and the CPU to copy it) — results in a denial of service. This issue has been patched in version 0.29.0.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":7.5,"severity":"high","source":"CNA: GitHub_M","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},{"score":7.5,"severity":"high","source":"NVD: security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"}],"modifiedAt":1794435450630,"publishedAt":1794435138353,"references":[{"source":"CNA: GitHub_M","tags":["x_refsource_CONFIRM"],"url":"https://github.com/fulgur-rs/fulgur/security/advisories/GHSA-vw2v-g4x7-xcqg"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/fulgur-rs/fulgur/pull/582"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/fulgur-rs/fulgur/pull/584"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/fulgur-rs/fulgur/commit/1c4cdad003daef7c9dc6ef1362c50bcfaac13ea9"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/fulgur-rs/fulgur/commit/9248fbfd91a2ba8fc3dbd9e44ba681f52ed1ecd0"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/fulgur-rs/fulgur/releases/tag/v0.29.0"},{"source":"security-advisories@github.com","tags":[],"url":"https://github.com/fulgur-rs/fulgur/commit/1c4cdad003daef7c9dc6ef1362c50bcfaac13ea9"},{"source":"security-advisories@github.com","tags":[],"url":"https://github.com/fulgur-rs/fulgur/commit/9248fbfd91a2ba8fc3dbd9e44ba681f52ed1ecd0"},{"source":"security-advisories@github.com","tags":[],"url":"https://github.com/fulgur-rs/fulgur/pull/582"},{"source":"security-advisories@github.com","tags":[],"url":"https://github.com/fulgur-rs/fulgur/pull/584"},{"source":"security-advisories@github.com","tags":[],"url":"https://github.com/fulgur-rs/fulgur/releases/tag/v0.29.0"},{"source":"security-advisories@github.com","tags":[],"url":"https://github.com/fulgur-rs/fulgur/security/advisories/GHSA-vw2v-g4x7-xcqg"}],"remediation":[],"revision":"3484759dec4f3b517db7fd4bfa4af2cb6490a2c5c3a45910020644f20702efd4","sources":[{"modifiedAt":1794435138353,"name":"CNA: GitHub_M","retrievedAt":1794438611237,"url":"https://www.cve.org/CVERecord?id=CVE-2026-68539"},{"modifiedAt":1794435450630,"name":"NVD","retrievedAt":1794443577963,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68539"}],"ssvc":null,"status":"published","title":"fulgur: Unbounded string-set value accumulation causes memory/CPU exhaustion (denial of service)","updatedAt":1794443577963}