Memory Allocation Vulnerability in Dompdf HTML to PDF Converter

CVE-2026-59941

What is CVE-2026-59941?

Dompdf, an HTML to PDF converter for PHP, has a vulnerability where it improperly processes BMP images. Versions up to 3.15 can accept BMP images with declared header dimensions that do not correlate with the actual pixel dimensions. This oversight allows attackers to supply an excessively large image size (e.g., a header declaring 6000×6000) without any file upload requirements or additional complex measures. This can lead to unnecessary memory allocation, causing significant performance degradation, as a single HTTP request can result in memory usage amplifying up to 12 times, reaching as much as 412 MB peak RSS. This issue has been addressed in version 3.16, so users are encouraged to update to mitigate the risk.

References