Denial of Service Vulnerability in Dompdf HTML to PDF Converter by Dompdf

CVE-2026-59942

What is CVE-2026-59942?

Dompdf, an HTML to PDF converter for PHP, is vulnerable to a Denial of Service (DoS) attack due to resource exhaustion in versions up to 3.15. An attacker can exploit this vulnerability by sending a specially crafted HTML document that includes a large image (e.g., 30,000x30,000 pixels). Although the application has checks for image dimensions, these can be bypassed using high-entropy images encoded in Base64 within specific CSS structures. The flaw arises because dimension validation occurs early, allowing processes to consume excessive CPU and memory during the rendering phase. Consequently, an unauthenticated attacker can cause the web server to experience a complete Denial of Service by submitting malformed HTML content. This issue has been resolved in version 3.16.

References