CVE-2026-59941 Dompdf: Uncontrolled resource consumption based on declared BMP dimensions
Attacker can cause excessive memory and CPU consumption via crafted BMP images in HTML, leading to denial of service in Dompdf.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-59941?
CVE-2026-59941 is a medium-severity denial of service vulnerability in dompdf, published on 28 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Dompdf is an HTML to PDF converter for PHP. Versions 3.15 and prior accept a BMP image and generates a PDF-compatible PNG based only on its declared header dimensions and never bounds width × height before the image is converted through GD. A 58-byte BMP whose header declares e.g. 6000×6000 is accepted and later drives imagecreatetruecolor($width, $height) (and PHP's native BMP decoder) to allocate the full pixel canvas. A payload can fit in a single HTTP request: the BMP can be inlined as a data:image/bmp;base64,… URI inside attacker-controlled HTML, so no upload, no remote fetch, and no chroot-reachable file is required. I measured a 169-byte request driving a dompdf render to ~412 MB peak RSS and ~4.8 s of CPU/wall time, versus ~34 MB for an identically-sized benign request — roughly a 12× memory amplification per request, repeatable and unauthenticated. This issue has been fixed in version 3.16.
Weakness: CWE-400
Which versions are affected by CVE-2026-59941?
2 open source packages ship an affected version, including dompdf/dompdf. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
dompdf/dompdf Packagist | All versions | 3.1.6 |
dompdf/dompdf Packagist | All versions | 3.1.6 |
Products include Dompdf Project Dompdf.
How do I fix CVE-2026-59941?
Upgrade dompdf/dompdf to 3.1.6 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-59941 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-59941 exists.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in dompdf
- CVE-2023-24813 URI validation failure on SVG parsing. Bypass of CVE-2023-23924
- CVE-2023-23924 URI validation failure on SVG parsing in Dompdf
- CVE-2021-3838 PHAR Deserialization in dompdf/dompdf
- CVE-2021-3902 Improper Restriction of XML External Entity Reference in dompdf/dompdf
- CVE-2022-28368 Remote code injection in dompdf/dompdf
Sources
Also known as DEBIAN-CVE-2026-59941, GHSA-8hg6-c449-896m, UBUNTU-CVE-2026-59941.