Read the docs
TI-2026-42748 Aliases CVE-2026-59941GHSA-8hg6-c449-896m

Dompdf: Uncontrolled resource consumption based on declared BMP dimensions

Priority MEDIUM 61CWE-400Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · Low
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-400.

Summary

Dompdf is an HTML to PDF converter for PHP. Versions 3.15 and prior accept a BMP image and generates a PDF-compatible PNG based only on its declared header dimensions and never bounds width × height before the image is converted through GD. A 58-byte BMP whose header declares e.g. 6000×6000 is accepted and later drives imagecreatetruecolor($width, $height) (and PHP's native BMP decoder) to allocate the full pixel canvas. A payload can fit in a single HTTP request: the BMP can be inlined as a data:image/bmp;base64,… URI inside attacker-controlled HTML, so no upload, no remote fetch, and no chroot-reachable file is required. I measured a 169-byte request driving a dompdf render to ~412 MB peak RSS and ~4.8 s of CPU/wall time, versus ~34 MB for an identically-sized benign request — roughly a 12× memory amplification per request, repeatable and unauthenticated. This issue has been fixed in version 3.16.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00644 51st percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed dompdf (dompdf): 3.1.6dompdf/dompdf (Packagist): 3.1.6

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
dompdfdompdfbefore 3.1.63.1.6Patch availableCNA
—dompdf/dompdf (Packagist)before 3.1.63.1.6Patch availableGHSA-8hg6-c449-896m
  • dompdf Vendordompdf Affected before 3.1.6 Fixed in 3.1.6 Patch available CNA
  • dompdf/dompdf (Packagist) Vendor— Affected before 3.1.6 Fixed in 3.1.6 Patch available GHSA-8hg6-c449-896m

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:dompdf_project:dompdf:*:*:*:*:*:*:*:*before 3.1.6VulnerableDompdf Project
  • cpe:2.3:a:dompdf_project:dompdf:*:*:*:*:*:*:*:* Versions before 3.1.6 Vulnerable ·Dompdf Project

Remediation

  • Fix · CNA dompdf (dompdf) Fixed in 3.1.6
  • Fix · GHSA-8hg6-c449-896m dompdf/dompdf (Packagist) Fixed in 3.1.6 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-59941
  2. 2026-10-03 Alias added: GHSA-8hg6-c449-896m
  3. 2026-10-21 EPSS moved to the 50th–90th percentile

References

Exploit 1

Patch 1

Other 2

  • TI-2023-10313 URI validation failure on SVG parsing. Bypass of CVE-2023-23924 CVSS 3.1CRITICAL 10.0
  • TI-2023-09722 URI validation failure on SVG parsing in Dompdf CVSS 3.1CRITICAL 10.0
  • TI-2021-02812 Improper Restriction of XML External Entity Reference in dompdf/dompdf CVSS 3.1CRITICAL 9.8
  • TI-2021-02769 PHAR Deserialization in dompdf/dompdf CVSS 3.1CRITICAL 9.8
  • TI-2024-16571 php-svg-lib lacks path validation on font through SVG inline styles CVSS 3.1CRITICAL 9.8
  • TI-2023-27479 php-svg-lib possible DoS caused by infinite recursion when parsing SVG document CVSS 3.1HIGH 7.5
See all 16 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences