Fulgur Rust Crate Vulnerability: Denial of Service Threat
- Severity
- HIGH
- Affected component
- fulgur (cargo)
- Affected versions
- < 0.26.0 or < 0.19.0 or >= 0.0.0-0, < 0.19.0 or >= 0.0.0-0, < 0.26.0
- Patched version
- 0.19.0
An early warning has been issued for a denial of service vulnerability in the fulgur Rust crate, which affects versions prior to 0.19.0. This vulnerability is due to unbounded page slicing from attacker-controlled CSS height.
What happened
The fulgur Rust crate, used for converting untrusted HTML/CSS into PDF, is reportedly vulnerable to a denial of service attack in versions prior to 0.19.0. This vulnerability arises from unbounded page slicing, which can be triggered by attacker-controlled CSS height. The issue has been tracked under the IDs GHSA-J5CX-PH8G-95V3 and GHSA-4rf6-qx84-q9fv. It is under investigation and has not yet been exploited in the wild.
To assess your exposure, check if your project uses the fulgur crate in a version affected by this vulnerability. The vulnerable versions are those prior to 0.19.0, specifically < 0.26.0 or < 0.19.0 or >= 0.0.0-0, < 0.19.0 or >= 0.0.0-0, < 0.26.0. If your project falls within these version ranges, you are potentially affected.
What to do about it
- Upgrade to fulgur 0.19.0 or later to mitigate the vulnerability.
- If an immediate upgrade is not possible, validate or constrain untrusted CSS before passing HTML to fulgur.
- Monitor the primary sources for updates on the vulnerability and any additional mitigation advice.
How 0Day would have caught this
fulgur is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
You are potentially affected if your project uses the fulgur crate in a version prior to 0.19.0, specifically < 0.26.0 or < 0.19.0 or >= 0.0.0-0, < 0.19.0 or >= 0.0.0-0, < 0.26.0.
What should I do right now?
Upgrade to fulgur 0.19.0 or later. If an immediate upgrade is not possible, validate or constrain untrusted CSS before passing HTML to fulgur.
Has this vulnerability been exploited in the wild?
No, this vulnerability has not yet been exploited in the wild according to the current information.