crates.io/fulgur CVE-2026-68537: high 7.5, EPSS 0.61%

Fulgur: Non-painting replaced elements amplify to thousands of blank PDF pages (denial of service)

Action: Upgrade fulgur to 0.26.0 or later.

cargo update -p fulgur --precise 0.26.0

Affected

Fixed versions

Sources

• osv: GHSA-4rf6-qx84-q9fv
• https://github.com/fulgur-rs/fulgur/security/advisories/GHSA-4rf6-qx84-q9fv
• https://github.com/fulgur-rs/fulgur/pull/575
• https://github.com/fulgur-rs/fulgur
• https://rustsec.org/advisories/RUSTSEC-2026-0201.html

CVE-2026-68537 · published 2026-09-17T18:49:15Z · modified 2026-09-17T19:10:53.126200232Z · JSON