CVE-2026-55555: Dompdf File Existence Oracle DoS Flaw

CVE-2026-55555 Overview

CVE-2026-55555 is an information disclosure vulnerability in Dompdf, an HTML to PDF converter for PHP. Versions 3.15 and prior are vulnerable to a File Existence Oracle attack through manipulation of the CSS @font-face directive. Attackers who can supply unsanitized HTML can reference local files repeatedly via the file:// protocol and observe distinct behavior depending on whether the referenced file exists. An existing file drives Dompdf into repeated processing until PHP triggers an Allowed memory size exhausted crash, while a missing file fails fast without hitting the memory limit. This observable discrepancy allows enumeration of sensitive files on the server, bypassing CHROOT restrictions. The issue is fixed in version 3.1.6.

Critical Impact
Attackers can enumerate arbitrary file paths on the server, defeating CHROOT restrictions, by using a memory-exhaustion oracle triggered through the CSS @font-face directive.

Affected Products

Dompdf versions 3.15 and prior
PHP applications embedding Dompdf for user-supplied HTML rendering
Deployments where $_dompdf_show_warnings=true and a low PHP memory limit are configured

Discovery Timeline

2026-07-28 - CVE-2026-55555 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-55555

Vulnerability Analysis

The vulnerability is classified under [CWE-203: Observable Discrepancy]. Dompdf processes CSS @font-face declarations and attempts to resolve referenced font files. When the referenced URL uses the file:// protocol and the file exists locally, Dompdf repeatedly processes it, allocating memory on each iteration until PHP terminates the request with a memory exhaustion error. When the file does not exist, Dompdf fails fast or ignores the reference without approaching the memory limit.

An attacker submits HTML containing many @font-face declarations that reference candidate local paths. By observing which requests terminate with memory exhaustion versus which complete normally, the attacker infers the existence of files on the server file system. The oracle operates independently of CHROOT restrictions because the discrepancy occurs before or during path resolution rather than at the point of file content disclosure.

Root Cause

The root cause is missing protocol and path validation during stylesheet URL resolution in src/Css/Stylesheet.php. Dompdf did not restrict which protocols could be dereferenced from CSS declarations, and it did not consistently short-circuit repeated processing of local file references. The $_dompdf_show_warnings=true setting amplifies the memory pressure required to reach the observable crash.

Attack Vector

Exploitation requires the attacker to submit unrestricted or unsanitized HTML in a request that permits large payloads. The attacker supplies HTML containing CSS @font-face rules with src: url("file:///path/to/probe") entries targeting the files to enumerate. The response behavior, whether the request completes or fails with a memory exhaustion error, reveals whether each probed file exists.

php

                $url,
                $this->_dompdf->getOptions()->getChroot()
            );
+
+            if ($path !== null && strpos($path, "blob:") !== 0) {
+                [$protocol] = Helpers::explode_url($path);
+                $options = $this->_dompdf->getOptions();
+                $allowed_protocols = $options->getAllowedProtocols();
+                if (!array_key_exists($protocol, $allowed_protocols)) {
+                    Helpers::record_warnings(E_USER_WARNING, "Permission denied on $path. The communication protocol is not supported.", __FILE__, __LINE__);
+                    $path = null;
+                }
+
+                foreach ($allowed_protocols[$protocol]["rules"] as $rule) {
+                    [$result, $message] = $rule($path);
+                    if ($result !== true) {
+                        Helpers::record_warnings(E_USER_WARNING, "Error loading $path: $message", __FILE__, __LINE__);
+                        $path = null;
+                    }
+                }
+            }
+
            if ($path === null) {
                $path = "none";
            }

Source: Dompdf security patch commit 75c39a08

The patch validates the protocol against an allowlist and applies additional rules before path resolution proceeds, eliminating the observable discrepancy for disallowed protocols such as file://.

Detection Methods for CVE-2026-55555

Indicators of Compromise

HTTP requests to Dompdf endpoints containing CSS @font-face declarations with file:// URLs in the src attribute
PHP error log entries reporting Allowed memory size of N bytes exhausted correlated with Dompdf rendering requests
Repeated requests from the same client differing only in file path parameters within embedded CSS

Detection Strategies

Inspect application logs for Dompdf render requests that terminate with fatal memory errors clustered in short time windows
Parse submitted HTML for @font-face rules referencing non-HTTP protocols and alert on file://, phar://, or other local protocol schemes
Monitor for high-volume, low-variance HTML submissions to PDF generation endpoints indicative of path enumeration

Monitoring Recommendations

Enable PHP error logging with memory exhaustion events forwarded to a centralized log platform for correlation
Track Dompdf version strings across deployed PHP applications through software composition analysis
Baseline normal PDF generation request size and payload composition to flag anomalies

How to Mitigate CVE-2026-55555

Immediate Actions Required

Upgrade Dompdf to version 3.1.6 or later across all applications that ingest untrusted HTML
Audit application code paths that pass user-supplied HTML to Dompdf and enforce server-side sanitization
Set $_dompdf_show_warnings=false in production to reduce memory pressure exploitable by the oracle

Patch Information

The fix is available in Dompdf v3.1.6. Review the GitHub Security Advisory GHSA-7x2p-4jvh-6384 and the v3.1.6 release notes for full details. The patch introduces protocol allowlist validation in src/Css/Stylesheet.php before URL resolution proceeds.

Workarounds

Restrict allowed protocols in Dompdf options so that file:// is not dereferenced during stylesheet resolution
Strip or sanitize @font-face declarations from user-supplied HTML before passing it to Dompdf
Raise the PHP memory_limit for the Dompdf worker process to eliminate the observable discrepancy, while noting this does not remove the underlying flaw

bash

# composer.json - pin Dompdf to a patched release
composer require dompdf/dompdf:^3.1.6

# Verify installed version
composer show dompdf/dompdf | grep versions