CVE-2026-59942

Dompdf, a widely used PHP library that converts HTML to PDF, is vulnerable to an unauthenticated denial-of-service flaw (CWE-400, uncontrolled resource consumption) affecting versions 3.15 and prior. An attacker supplies HTML containing a single image with extreme dimensions (e.g., 30,000x30,000 pixels), encoded as high-entropy Base64 data and wrapped in specific CSS containers, which bypasses Dompdf's early dimension-validation checks; during rendering, bounding-box and internal buffer calculations then consume unbounded CPU time and memory. The attacker gains the ability to crash the PHP process, completely denying service to PDF generation and potentially to the web application sharing that process. Any application that lets users supply HTML content or URLs that are then converted to PDF with Dompdf is affected; applications that only render internally generated documents are less directly exposed. No in-the-wild exploitation is reported (EPSS 0.7%, not in CISA KEV), but a public security advisory with proof-of-concept details exists and a fix is available in version 3.16.

What to do: Upgrade Dompdf to version 3.16 or later, and verify that transitive dependencies (e.g., PHP frameworks or CMS plugins that bundle Dompdf) pull in the fixed release. As interim mitigation, sanitize or restrict user-supplied HTML, cap image dimensions and Base64 image size, and enforce strict per-render PHP memory and execution-time limits. Prioritize auditing any application that converts end-user-provided HTML or URLs to PDF, since those configurations are the directly exploitable ones.