CVE-2026-59942 Details

A denial-of-service vulnerability has been identified in Dompdf, an HTML to PDF converter for PHP, affecting versions through 3.15. This vulnerability allows for resource exhaustion, where an attacker can crash the PHP process by uploading a specially crafted HTML document. The document must contain a single image with extremely large dimensions, such as 30,000 by 30,000 pixels. Although Dompdf has internal checks to validate image sizes, these can be circumvented by using a high-entropy image, like random noise, encoded in Base64 and placed within certain CSS containers. The issue arises because the initial dimension validation occurs early in the process, but the subsequent resource allocation for rendering the image does not effectively limit the total CPU time or memory usage for a single object that has already passed the size check. As a result, an unauthenticated remote attacker can cause a complete denial-of-service on the web server by sending a manipulated HTML string. This vulnerability impacts any application that permits users to submit HTML content or URLs that are later converted to PDF using Dompdf.

Users can upgrade to Dompdf version 3.1.6, which addresses this vulnerability by implementing proper image size limits based on byte size.