CVE-2026-59942: Dompdf: Denial of Service (DoS) via Resource Exhaustion using Oversized Image Bitmaps
Dompdf v3.1.5 is vulnerable to a Denial of Service (DoS) attack via resource exhaustion. An attacker can crash the PHP process by providing a specially crafted HTML document containing a single image with massive dimensions (e.g., 30,000x30,000 pixels).
While Dompdf implements internal checks to validate image dimensions, these can be bypassed by using a high-entropy image (such as random noise) encoded in Base64 and wrapped in specific CSS containers.
References
- github.com/advisories/GHSA-f5gf-2cj8-52g2
- github.com/dompdf/dompdf/commit/7c65e7bbeccf146b2409740405af73949ad129d0
- github.com/dompdf/dompdf/commit/89164eaabe0bb50c462f0b24f740044ba5fb0f99
- github.com/dompdf/dompdf/releases/tag/v3.1.6
- github.com/dompdf/dompdf/security/advisories/GHSA-f5gf-2cj8-52g2
- nvd.nist.gov/vuln/detail/CVE-2026-59942
Code Behaviors & Features
Detect and mitigate CVE-2026-59942 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →