CVE-2026-68539

Name of the Vulnerable Software and Affected Versions fulgur versions 0.4.4 through 0.28.x

Description fulgur converts untrusted HTML/CSS into PDF. A flaw exists where CSS string-set named-string values resolved from a document are accumulated per element without a memory budget. This allows a small, specially crafted document to cause excessive memory retention and high CPU usage during copying, leading to a denial of service.

Recommendations Update to version 0.29.0.