CVE-2026-55555

Name of the Vulnerable Software and Affected Versions Dompdf versions prior to 3.16

Description Dompdf is subject to a File Existence Oracle attack via the manipulation of the CSS @font-face directive. An attacker can provide malicious HTML that repeatedly references local files using the file:// protocol to trigger PHP memory exhaustion. The system exhibits a discrepancy in behavior: if a referenced local file exists, it is processed repeatedly until an "Allowed memory size exhausted" crash occurs; if the file is missing, the process fails quickly or ignores the import without hitting the memory limit. This difference allows an attacker to enumerate sensitive files on the server, bypassing CHROOT restrictions. Successful exploitation requires the ability to supply unrestricted or unsanitized HTML in a request that accepts large data, and a configuration where the memory limit is low enough to be exhausted, which can be further facilitated by setting $ dompdf show warnings to true.

Recommendations Update Dompdf to version 3.16. Restrict the use of the @font-face directive in user-supplied HTML to prevent the triggering of the memory exhaustion oracle.