Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
fulgur converts untrusted HTML/CSS into PDF, commonly on a server that processes input supplied by many tenants. In versions prior to 0.26.0, a childless box that resolves to a pathologically tall height was amplified into thousands of blank PDF pages, even when it produces no visible output. The childless-collapse defense that would normally collapse such a box was gated by a tag-only "replaced content" check, so any non-painting replaced element bypassed it, including: - an unresolved src (the common offline-first case), - a visibility:hidden image, - an undecodable image format, and - an empty <svg. A trailing-sibling variant of the same gap was also open. A few bytes of HTML therefore amplified into roughly MAXPAGES (10,000) blank pages; the renderer allocates and runs a per-page loop over them, producing CPU and memory exhaustion. An attacker able to submit HTML to a fulgur-based conversion service can trigger this with a trivially small payload, denying service to the host and…
Recommended action: Upgrade to 0.26.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
fulgur converts untrusted HTML/CSS into PDF, commonly on a server that processes input supplied by many tenants. In versions prior to 0.19.0, a body-direct child whose CSS-resolved height greatly exceeds the page height was sliced into one fragment per page with no upper bound. The height is taken directly from attacker-controlled HTML/CSS (height, vh units), so a few bytes such as: forced on the order of 125,000 page fragments. The pagination code then allocates vec![Vec::new(); pagecount] and runs a per-page render loop, resulting in CPU and memory exhaustion. A non-finite height (one that resolves to +inf) additionally made the slicing loop's remaining -= lastsliceh decrement never terminate, causing an infinite loop. An attacker able to submit HTML/CSS to a fulgur-based conversion service can trigger this with a trivially small payload, denying service to the host and any co-tenants. Patches Fixed in 0.19.0. A MAXPAGES cap bounds the slice loop — halting it even for a +inf height…
Recommended action: Upgrade to 0.19.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.