Executive brief
Fulgur is an HTML-to-PDF converter used on servers that process documents from multiple users. A flaw allows a small HTML payload to generate thousands of blank pages, exhausting CPU and memory on the server. An attacker can submit a malicious HTML document to trigger this, causing the service to become unavailable to all users.
Technical details
The vulnerability is a denial-of-service amplification in the childless-box collapse logic. Non-painting replaced elements (such as images with missing src attributes, visibility:hidden images, undecodable image formats, or empty SVG elements) bypass a tag-only safety check and resolve to pathologically tall heights. The renderer allocates and iterates over up to 10,000 blank pages per malicious document, causing CPU and memory exhaustion. The flaw also affects trailing-sibling elements. This is a network-based DoS attack requiring no authentication, though the adversary must be able to supply HTML to the conversion service. The fix removes the tag-only gate, collapsing any pathologically tall childless box regardless of replaced-element status.
Affected products
- Fulgur fulgur prior to 0.26.0
Timeline
- 2026-09-17: disclosed: Advisory GHSA-4rf6-qx84-q9fv published
- 2026-09-17: patched: Fixed in version 0.26.0 via PR #575