CVE-2026-59941: Dompdf HTML to PDF Converter DoS Flaw

CVE-2026-59941 Overview

CVE-2026-59941 is a resource exhaustion vulnerability in Dompdf, an HTML-to-PDF converter for PHP. Versions 3.1.5 and earlier accept BMP images and generate PDF-compatible PNGs based solely on declared header dimensions. Dompdf never bounds the width × height product before passing the image through PHP's GD library. An unauthenticated attacker can inline a 58-byte BMP as a data:image/bmp;base64,… URI inside attacker-controlled HTML. This drives imagecreatetruecolor($width, $height) to allocate the full pixel canvas. The issue is tracked as [CWE-400] Uncontrolled Resource Consumption and is fixed in version 3.1.6.

Critical Impact
A 169-byte request can drive a Dompdf render to approximately 412 MB peak RSS and 4.8 seconds of CPU/wall time, versus 34 MB for an equivalent benign request — a 12× memory amplification per unauthenticated request.

Affected Products

Dompdf versions 3.1.5 and prior
PHP applications embedding Dompdf for HTML-to-PDF conversion
Web services exposing Dompdf rendering to untrusted HTML input

Discovery Timeline

2026-07-28 - CVE-2026-59941 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-59941

Vulnerability Analysis

Dompdf's image cache reads the width, height, and type fields directly from the BMP header without validating the total pixel count. The parser then calls imagecreatetruecolor($width, $height) to build a truecolor canvas matching those declared dimensions. A 58-byte BMP declaring 6000×6000 pixels forces allocation of a 36-megapixel canvas, consuming hundreds of megabytes of RAM per request. Because Dompdf accepts inline data: URIs, the attacker embeds the malicious BMP directly in submitted HTML. No file upload, no remote fetch, and no chroot-reachable file is required. Repeatable unauthenticated requests can drive process memory to ~412 MB peak resident set size with ~4.8s of CPU time each, quickly exhausting the PHP-FPM worker pool.

Root Cause

The vulnerable code path in src/Image/Cache.php retrieves image metadata through Helpers::dompdf_getimagesize() and validates only that width, height, and type are non-empty and of a supported format. It does not verify that width × height stays within any resource budget, nor does it check the estimated in-memory footprint before invoking the GD decoder.

Attack Vector

An unauthenticated attacker submits HTML containing a small BMP encoded as a data:image/bmp;base64,… URI. When Dompdf renders the document, it decodes the header, trusts the declared dimensions, and allocates a full pixel canvas via GD. Repeating the request in parallel exhausts PHP worker memory and CPU, denying service to legitimate users.

php

// Patched validation logic in src/Image/Cache.php (v3.1.6)
list($width, $height, $type, , , , , $imageBytes) = Helpers::dompdf_getimagesize($resolved_url, $options->getHttpContext());

if (($width && $height && in_array($type, ["gif", "png", "jpeg", "bmp", "svg","webp"], true)) === false) {
    throw new ImageException("Image type unknown", E_WARNING);
}

$maxImageBytes = $options->getImageByteSizeLimit();
if ($width <= 0 || $height <= 0 || ($maxImageBytes > 0 && ($imageBytes === null || $imageBytes > $maxImageBytes))) {
    throw new ImageException("Image dimensions or size exceed the configured limit", E_WARNING);
}
// Source: [Dompdf commit 7c65e7b](https://github.com/dompdf/dompdf/commit/7c65e7bbeccf146b2409740405af73949ad129d0)

Detection Methods for CVE-2026-59941

Indicators of Compromise

HTTP request bodies containing data:image/bmp;base64, URIs directed at Dompdf-backed PDF endpoints.
PHP-FPM or Apache worker processes showing sudden RSS growth into the hundreds of megabytes during PDF generation.
Repeated ImageException entries or PHP memory-limit fatal errors in Dompdf log output.
Unauthenticated requests to /pdf, /export, /render, or similar routes correlated with worker restarts.

Detection Strategies

Inspect application logs for BMP data: URIs submitted through HTML input fields consumed by Dompdf.
Alert on PHP worker RSS crossing a baseline threshold (for example, >200 MB) during PDF generation calls.
Monitor for PHP Fatal error: Allowed memory size events tied to Dompdf or Image/Cache.php stack frames.

Monitoring Recommendations

Track request-to-render time on PDF endpoints; flag outliers exceeding several seconds from unauthenticated sources.
Rate-limit anonymous PDF generation and record source IPs with elevated concurrency.
Emit metrics on GD memory allocation size where feasible, and correlate spikes with client identifiers.

How to Mitigate CVE-2026-59941

Immediate Actions Required

Upgrade Dompdf to version 3.1.6 or later, which introduces the imageByteSizeLimit option and enforces dimension checks.
Set imageByteSizeLimit in Options to a value appropriate for your workload; the default -1 disables the check.
Restrict PDF-generation endpoints to authenticated sessions where feasible and apply per-user rate limits.
Lower memory_limit and max_execution_time in php.ini for PHP workers rendering untrusted HTML.

Patch Information

The fix is delivered in Dompdf release v3.1.6 via commit 7c65e7b. The advisory is published as GHSA-8hg6-c449-896m. The patch adds a byte-size budget check in src/Image/Cache.php and a new imageByteSizeLimit field in src/Options.php.

Workarounds

Strip or reject data:image/bmp URIs from user-supplied HTML before passing it to Dompdf.
Disable BMP support by filtering the type returned from dompdf_getimagesize() upstream of the renderer.
Run Dompdf inside a resource-constrained container or cgroup with hard memory ceilings to bound blast radius.
Front the PDF endpoint with a WAF rule that blocks inline base64 BMP payloads and enforces request body size limits.

bash

# Configuration example: enforce an image byte-size limit in Dompdf 3.1.6+
php -r '
require "vendor/autoload.php";
$options = new Dompdf\Options();
$options->set("imageByteSizeLimit", 5 * 1024 * 1024); // 5 MB cap on decoded image size
$options->set("isRemoteEnabled", false);
$dompdf = new Dompdf\Dompdf($options);
$dompdf->loadHtml($untrustedHtml);
$dompdf->render();
'