{"answers":{"affected":"2 open source packages ship an affected version, including dompdf/dompdf. It affects 1 product.","exploited":"There is no known exploitation of CVE-2023-50262 in the wild and no public exploit code.","fix":"Upgrade dompdf/dompdf to 2.0.4 or later.","what":"CVE-2023-50262 is a medium-severity denial of service vulnerability in dompdf, published on 13 Dec 2023. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2023-50262 and fix it if it is affected.\n\nWhat it is: CVE-2023-50262 is a medium-severity denial of service vulnerability in dompdf, published on 13 Dec 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2023-50262 in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- dompdf/dompdf (Packagist): affected all versions; fixed in 2.0.4\n- dompdf/dompdf (Packagist): affected all versions; fixed in 2.0.4\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2023-50262/ (Markdown: https://insights.sbomify.com/CVE-2023-50262/index.md)","id":"CVE-2023-50262","markdown":"https://insights.sbomify.com/CVE-2023-50262/index.md","name":"CVE-2023-50262","record":{"aliases":["DEBIAN-CVE-2023-50262","GHSA-3qx2-6f78-w2j2"],"analysis":{"component_type":"library","fix_type":"upgrade","impacts":["denial_of_service"],"network_reachable":"yes","non_default_config":false,"product_category":"PHP HTML to PDF library","requires_auth":"none","summary":"An attacker can cause a denial of service in Dompdf by sending malicious SVG images that trigger infinite recursion, exhausting system resources.","user_interaction":"not_required","vuln_class":"denial_of_service"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"GitHub_M","cpe":[{"product":"dompdf","vendor":"dompdf_project"}],"cvss":{"score":5.3,"severity":"medium","source":"cna","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","version":"3.1"},"cwes":[{"id":"CWE-674","name":"Uncontrolled Recursion"},{"id":"CWE-20","name":"Improper Input Validation"}],"description":"Dompdf is an HTML to PDF converter for PHP. When parsing SVG images Dompdf performs an initial validation to ensure that paths within the SVG are allowed. One of the validations is that the SVG document does not reference itself. However, prior to version 2.0.4, a recursive chained using two or more SVG documents is not correctly validated. Depending on the system configuration and attack pattern this could exhaust the memory available to the executing process and/or to the server itself.\n\nphp-svg-lib, when run in isolation, does not support SVG references for `image` elements. However, when used in combination with Dompdf, php-svg-lib will process SVG images referenced by an `image` element. Dompdf currently includes validation to prevent self-referential `image` references, but a chained reference is not checked. A malicious actor may thus trigger infinite recursion by chaining references between two or more SVG images.\n\nWhen Dompdf parses a malicious payload, it will crash due after exceeding the allowed execution time or memory usage. An attacker sending multiple request to a system can potentially cause resource exhaustion to the point that the system is unable to handle incoming request.\n\nVersion 2.0.4 contains a fix for this issue.","ecosystems":["Packagist"],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"Dompdf possible DoS caused by infinite recursion when parsing SVG images","id":"CVE-2023-50262","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":"Packagist","product":null,"products":[],"type":"denial_of_service","year":"2023"},"n_packages":2,"n_references":3,"next":{"headline":"Nautobot allows unauthenticated db-file-storage views","id":"CVE-2023-50263"},"packages":[{"ecosystem":"Packagist","fixed":["2.0.4"],"introduced":["0"],"last_affected":[],"package":"dompdf/dompdf","purl":null,"source":"GHSA-3qx2-6f78-w2j2"},{"ecosystem":"Packagist","fixed":["2.0.4"],"introduced":["0"],"last_affected":[],"package":"dompdf/dompdf","purl":"pkg:composer/dompdf/dompdf","source":"GHSA-3qx2-6f78-w2j2"}],"prev":{"headline":"Wazuh's vulnerability in host_deny AR script allows arbitrary command execution","id":"CVE-2023-50260"},"products":["dompdf"],"published":"2023-12-13","related":[{"cvss_score":10,"headline":"URI validation failure on SVG parsing. Bypass of CVE-2023-23924","id":"CVE-2023-24813","kev_date_added":null,"published":"2023-02-07"},{"cvss_score":10,"headline":"URI validation failure on SVG parsing in Dompdf","id":"CVE-2023-23924","kev_date_added":null,"published":"2023-01-31"},{"cvss_score":9.8,"headline":"PHAR Deserialization in dompdf/dompdf","id":"CVE-2021-3838","kev_date_added":null,"published":"2024-11-15"},{"cvss_score":9.8,"headline":"Improper Restriction of XML External Entity Reference in dompdf/dompdf","id":"CVE-2021-3902","kev_date_added":null,"published":"2024-11-15"},{"cvss_score":9.8,"headline":"Remote code injection in dompdf/dompdf","id":"CVE-2022-28368","kev_date_added":null,"published":"2022-04-03"},{"cvss_score":8.8,"headline":"DOMPDF Remote Code Execution","id":"CVE-2014-5013","kev_date_added":null,"published":"2020-01-10"},{"cvss_score":7.5,"headline":"Dompdf allows remote file inclusion because URI validation failure does not halt font registration","id":"CVE-2022-41343","kev_date_added":null,"published":"2022-09-25"}],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":"PUBLISHED","updated":"2024-08-02","vendors":["dompdf"]},"summary":"An attacker can cause a denial of service in Dompdf by sending malicious SVG images that trigger infinite recursion, exhausting system resources.","url":"https://insights.sbomify.com/CVE-2023-50262/"}