CVE-2026-59942

Received Received - Intake

Dompdf Resource Exhaustion DoS via Malicious Image

Publication date: 2026-07-28

Last updated on: 2026-07-28

Assigner: GitHub, Inc.

Description

Dompdf is an HTML to PDF converter for PHP. Versions 3.15 and prior are vulnerable to a Denial of Service (DoS) attack via resource exhaustion. An attacker can crash the PHP process by providing a specially crafted HTML document containing a single image with massive dimensions (e.g., 30,000x30,000 pixels). While Dompdf implements internal checks to validate image dimensions, these can be bypassed by using a high-entropy image (such as random noise) encoded in Base64 and wrapped in specific CSS containers. The vulnerability exists because the dimension validation happens early, but the resource allocation for calculating the object's bounding box and internal buffers during the rendering phase does not strictly limit the cumulative CPU time or memory usage for a single object that has passed the initial check. An unauthenticated remote attacker can cause a complete Denial of Service on the web server by submitting a crafted HTML string. This affects any application that allows users to provide HTML content or URLs that are subsequently converted to PDF using Dompdf. This issue has been fixed in version 3.16.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-28

Last Modified

2026-07-28

Generated

2026-07-29

AI Q&A

2026-07-29

EPSS Evaluated

N/A

NVD

CVE-2026-59942

Affected Vendors & Products

Vendor	Product	Version / Range
dompdf	dompdf	to 3.16 (exc)
dompdf	dompdf	3.16

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-400	The product does not properly control the allocation and maintenance of a limited resource.

Attack-Flow Graph

Executive Summary

Dompdf is a PHP library that converts HTML to PDF. Versions 3.15 and earlier have a Denial of Service (DoS) vulnerability. Attackers can crash the PHP process by submitting an HTML document with a single massive image (e.g., 30,000x30,000 pixels). The image is encoded in Base64 with high entropy and wrapped in specific CSS containers to bypass initial dimension checks. The vulnerability occurs because resource allocation during rendering is not strictly limited, allowing CPU or memory exhaustion.

Detection Guidance

Monitor for unusual CPU or memory spikes during PDF generation. Check web server logs for requests containing large image dimensions or Base64-encoded data. Use tools like 'top' or 'htop' to observe process resource usage when processing HTML to PDF conversions.

Impact Analysis

If you use Dompdf in your application, an unauthenticated remote attacker could crash your web server by submitting a specially crafted HTML document. This would cause a complete Denial of Service, making your application unavailable to legitimate users. The attack requires no authentication and can be executed remotely.

Compliance Impact

This vulnerability could indirectly impact compliance with GDPR and HIPAA by causing service disruptions. A DoS attack may lead to downtime, potentially violating availability requirements in these regulations. For GDPR, this could affect data processing operations, while for HIPAA, it might disrupt access to protected health information.

Mitigation Strategies

Upgrade Dompdf to version 3.16 or later immediately. If upgrading is not possible, restrict user input for HTML to PDF conversion by limiting image dimensions and disabling Base64-encoded image processing. Implement rate limiting on PDF generation endpoints to prevent abuse.

Hi! I’m here to help you understand CVE-2026-59942. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70