CVE-2026-68538

Name of the Vulnerable Software and Affected Versions fulgur versions 0.15.0 through 0.26.x

Description fulgur converts untrusted HTML/CSS into PDF. The resolution of the CSS counters(name, sep) function in generated content lacks bounds on the size of a single expansion and the aggregate work across an element tree. An attacker can submit a small HTML/CSS payload to trigger CPU and memory exhaustion, resulting in a denial of service for the host and other tenants.

Recommendations Update to version 0.27.0.