CVE-2026-59942 in Dompdf
Summary
by MITRE • 07/29/2026
Dompdf is an HTML to PDF converter for PHP. Versions 3.15 and prior are vulnerable to a Denial of Service (DoS) attack via resource exhaustion. An attacker can crash the PHP process by providing a specially crafted HTML document containing a single image with massive dimensions (e.g., 30,000x30,000 pixels). While Dompdf implements internal checks to validate image dimensions, these can be bypassed by using a high-entropy image (such as random noise) encoded in Base64 and wrapped in specific CSS containers. The vulnerability exists because the dimension validation happens early, but the resource allocation for calculating the object's bounding box and internal buffers during the rendering phase does not strictly limit the cumulative CPU time or memory usage for a single object that has passed the initial check. An unauthenticated remote attacker can cause a complete Denial of Service on the web server by submitting a crafted HTML string. This affects any application that allows users to provide HTML content or URLs that are subsequently converted to PDF using Dompdf. This issue has been fixed in version 3.16.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 07/29/2026
The dompdf library represents a widely-used PHP solution for converting HTML documents into PDF format, making it a critical component in numerous web applications that require document generation capabilities. When examining the vulnerability affecting versions 3.15 and prior, the core issue manifests as a resource exhaustion attack that can completely incapacitate the PHP process through carefully crafted input. This vulnerability specifically targets the library's handling of image dimensions within HTML documents, creating a scenario where an attacker can deliberately crash web servers by submitting malicious content that appears innocuous but contains computationally expensive elements.
The technical flaw resides in the library's validation mechanism for image dimensions, which operates at an early stage of processing but fails to adequately protect against resource-intensive inputs. While dompdf does implement initial checks to validate image dimensions, these safeguards prove insufficient when confronted with high-entropy images such as random noise patterns encoded in base64 format. The vulnerability becomes exploitable when attackers wrap these massive dimension images within specific CSS containers that bypass the early validation phase. This design flaw demonstrates a classic case of incomplete input sanitization where the initial security checks are circumvented by manipulating the data structure rather than the content itself.
The operational impact of this vulnerability extends far beyond simple service disruption, as it enables complete denial of service conditions that can bring entire web applications to their knees. An unauthenticated remote attacker requires no special privileges or credentials to exploit this weakness, making it particularly dangerous in environments where user input is processed without proper sanitization. The attack vector specifically targets the rendering phase of dompdf where internal buffers and bounding box calculations occur, allowing malicious inputs to consume excessive CPU time and memory resources that can overwhelm the hosting server. Applications vulnerable to this issue include content management systems, document generation services, and any web platform that accepts HTML content for PDF conversion, creating a widespread attack surface across numerous software ecosystems.
The underlying architectural weakness stems from the mismatch between early validation and late resource allocation in the processing pipeline, where dimension checks occur before actual resource consumption but the rendering phase does not enforce cumulative usage limits. This vulnerability aligns with CWE-400, which categorizes resource exhaustion issues as a critical concern in software security, particularly when attackers can manipulate resource consumption patterns through input manipulation. From an ATT&CK framework perspective, this represents a privilege escalation and denial of service technique that leverages application-specific weaknesses to consume system resources beyond normal operational parameters. The fix implemented in version 3.16 addresses the core issue by strengthening both the dimension validation checks and implementing more robust resource allocation limits during the rendering phase, ensuring that even if bypass attempts are successful, the system remains protected against excessive consumption patterns.
Organizations utilizing dompdf should prioritize immediate upgrade to version 3.16 or later to address this vulnerability, as the attack requires no authentication and can be executed through any web interface that processes HTML content for PDF generation. Security teams should also implement additional input validation measures at application layers to further protect against similar vulnerabilities in other libraries and components that may exhibit similar resource consumption patterns. The incident highlights the importance of comprehensive security testing that includes stress scenarios involving extreme input values rather than just standard validation checks, particularly when dealing with rendering engines and document processing libraries that handle user-supplied content.