CVE-2026-59941 Details
Description
Dompdf is an HTML to PDF converter for PHP. Versions 3.15 and prior accept a BMP image and generates a PDF-compatible PNG based only on its declared header dimensions and never bounds width × height before the image is converted through GD. A 58-byte BMP whose header declares e.g. 6000×6000 is accepted and later drives imagecreatetruecolor($width, $height) (and PHP's native BMP decoder) to allocate the full pixel canvas. A payload can fit in a single HTTP request: the BMP can be inlined as a data:image/bmp;base64,… URI inside attacker-controlled HTML, so no upload, no remote fetch, and no chroot-reachable file is required. I measured a 169-byte request driving a dompdf render to ~412 MB peak RSS and ~4.8 s of CPU/wall time, versus ~34 MB for an identically-sized benign request — roughly a 12× memory amplification per request, repeatable and unauthenticated. This issue has been fixed in version 3.16.
A denial-of-service vulnerability has been identified in Dompdf, an HTML to PDF converter for PHP, affecting versions through 3.15. The issue arises when BMP images are processed. Dompdf generates a PDF-compatible PNG based solely on the declared dimensions in the BMP header, without verifying the actual pixel data. This flaw allows a 58-byte BMP, with a header claiming dimensions like 6000x6000, to be accepted. Exploitation involves sending a crafted BMP image as a data URI within HTML, bypassing the need for file uploads or remote fetching. The vulnerability leads to significant resource exhaustion, with reported memory usage peaking at around 412 MB and causing approximately 4.8 seconds of CPU time per request, compared to just 34 MB for a normal request. This memory amplification is repeatable and does not require authentication.
Users can update to Dompdf version 3.1.6, which addresses this vulnerability by implementing checks on the declared dimensions of BMP images before processing them.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 29, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/dompdf/dompdf/security/advisories/GHSA-8hg6-c449-896m | CISA-ADP | ExploitVendor Advisory |
| https://github.com/dompdf/dompdf/commit/7c65e7bbeccf146b2409740405af73949ad129d0 | [email protected] | Patch |
| https://github.com/dompdf/dompdf/releases/tag/v3.1.6 | [email protected] | Release Notes |
| https://github.com/dompdf/dompdf/security/advisories/GHSA-8hg6-c449-896m | [email protected] | ExploitVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-400 | Uncontrolled Resource Consumption | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| dompdf project dompdf | < 3.1.6 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 4, 2026 | Initial Analysis | [email protected] |
| Jul 29, 2026 | CVE Modified | CISA-ADP |
| Jul 28, 2026 | New CVE Received | [email protected] |