CVE-2026-59942

Name of the Vulnerable Software and Affected Versions Dompdf versions prior to 3.16

Description Dompdf is susceptible to a Denial of Service (DoS) attack via resource exhaustion. An unauthenticated remote attacker can crash the PHP process by submitting a specially crafted HTML document containing a single image with massive dimensions, such as 30,000x30,000 pixels. Although the software performs initial dimension validation, this can be bypassed using a high-entropy image (such as random noise) encoded in Base64 and wrapped in specific CSS containers.

The issue occurs because resource allocation for calculating the object's bounding box and internal buffers during the rendering phase—specifically when the render() function is called—does not strictly limit cumulative CPU time or memory usage for objects that passed the initial check. Processing a high-entropy image forces the engine to handle the uncompressed bitmap in memory, leading to 100% CPU saturation and massive memory allocation (approximately 1.2 GB for a single image), which triggers a fatal error or an OS-level SIGKILL (Out of Memory), resulting in a complete server crash.

Recommendations Update to version 3.16.