high CVSS 7.5

CVE-2026-59942·PHP vulnerability

Dompdf is an HTML to PDF converter for PHP. Versions 3.15 and prior are vulnerable to a Denial of Service (DoS) attack via resource exhaustion. An attacker can crash the PHP process by providing a specially crafted HTML document containing a single image with massive dimensions (e.g., 30,000x30,000 pixels). While Dompdf implements internal checks to validate image dimensions, these can be bypassed by using a high-entropy image (such as random noise) encoded in Base64 and wrapped in specific CSS containers. The vulnerability exists because the dimension validation happens early, but the resource allocation for calculating the object's bounding box and internal buffers during the rendering phase does not strictly limit the cumulative CPU time or memory usage for a single object that has passed the initial check. An unauthenticated remote attacker can cause a complete Denial of Service on the web server by submitting a crafted HTML string. This affects any application that allows users to provide HTML content or URLs that are subsequently converted to PDF using Dompdf. This issue has been fixed in version 3.16.

Severity
high
Software
PHP
Fixed in
3.1.6
Published
2026-07-28

Affected versions

Until: 3.1.6

Fixed in: 3.1.6

How to fix this CVE

Update PHP and Dompdf to version 3.1.6 or later to address a resource exhaustion vulnerability in the HTML-to-PDF conversion process. Applications using Dompdf to process user-supplied HTML must prioritize this patch, as attackers can trigger server crashes by submitting specially crafted documents with oversized image elements. Verify the update is applied and test PDF generation workflows before deploying to production.

sudo dnf update php

Defensia detects this vulnerability

What an exploitation attempt looks like

Sample log line indicative of exploitation attempts:

POST/GET request with HTML payload containing <img> or <image> tags with src containing Base64-encoded high-entropy data (random noise pattern) and CSS dimensions > 10000x10000 pixels, often wrapped in divs with fixed dimensions; correlated with PHP process memory spikes or fatal errors

WAF mitigation (if patching is not yet possible)

Add this rule to your WAF to block exploitation attempts while you schedule the patch. 

Implement content-length limits on HTML file uploads (max 5MB recommended) and validate that img src attributes reference legitimate external URLs or reject inline Base64 image data in user-submitted HTML. Block HTML payloads containing img tags with computed dimensions exceeding 5000x5000 pixels.

How to check if you are affected

  1. Check installed Dompdf version: grep -r '"version"' /path/to/vendor/dompdf/dompdf/composer.json or php -r "require 'vendor/autoload.php'; echo Dompdf\\Dompdf::VERSION;"
  2. Identify applications accepting HTML input for PDF conversion: grep -r 'Dompdf' /var/www --include='*.php' to locate usage patterns
  3. Search PHP error logs for memory exhaustion or timeout messages: grep -E '(Allowed memory|Maximum execution time|Out of memory)' /var/log/php-fpm/error.log or /var/log/apache2/error.log
  4. Verify the fix by confirming Dompdf version is 3.1.6+: php -r "require 'vendor/autoload.php'; echo Dompdf\\Dompdf::VERSION;" returns 3.1.6 or higher

FAQ

What is CVE-2026-59942?

CVE-2026-59942 is a Denial of Service vulnerability in Dompdf that allows attackers to crash PHP processes by submitting HTML documents with extremely large image dimensions encoded in Base64, bypassing initial validation checks during the rendering phase.

Is CVE-2026-59942 being actively exploited?

No, this vulnerability is not currently listed on the CISA Known Exploited Vulnerabilities catalog, and no public exploits are available. However, the attack is straightforward to execute and organizations should patch proactively.

What versions of PHP are affected by CVE-2026-59942?

Dompdf versions 3.1.5 and earlier are vulnerable. Dompdf 3.1.6 and later contain the fix. Any PHP installation using a vulnerable version of Dompdf is at risk.

How do I check if my server is vulnerable to CVE-2026-59942?

Run: php -r "require 'vendor/autoload.php'; echo Dompdf\\Dompdf::VERSION;" — if the output is 3.1.5 or lower, your installation is vulnerable and requires immediate patching.

Does Defensia detect CVE-2026-59942?

Yes — Defensia's CVE advisory scanner compares installed package versions against the NVD database. If Dompdf is installed on a monitored server, CVE-2026-59942 will appear in your dashboard with remediation steps.

Related PHP CVEs

CVE-2026-28289CVSS 10FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. A patch bypass vulnerability for CVE-2026-27636 in FreeScout 1.8.206 and earlier allows any authenticated user with file upload permissions to achieve Remote Code Execution (RCE) on the server by uploading a malicious .htaccess file using a zero-width space character prefix to bypass the security check. The vulnerability exists in the sanitizeUploadedFileName() function in app/Http/Helper.php. The function contains a Time-of-Check to Time-of-Use (TOCTOU) flaw where the dot-prefix check occurs before sanitization removes invisible characters. This vulnerability is fixed in 1.8.207.
CVE-2025-46348CVSS 10YesWiki is a wiki system written in PHP. Prior to version 4.5.4, the request to commence a site backup can be performed and downloaded without authentication. The archives are created with a predictable filename, so a malicious user could create and download an archive without being authenticated. This could result in a malicious attacker making numerous requests to create archives and fill up the file system, or by downloading the archive which contains sensitive site information. This issue has been patched in version 4.5.4.
CVE-2025-47916CVSS 10Invision Community 5.0.0 before 5.0.7 allows remote code execution via crafted template strings to themeeditor.php. The issue lies within the themeeditor controller (file: /applications/core/modules/front/system/themeeditor.php), where a protected method named customCss can be invoked by unauthenticated users. This method passes the value of the content parameter to the Theme::makeProcessFunction() method; hence it is evaluated by the template engine. Accordingly, this can be exploited by unauthenticated attackers to inject and execute arbitrary PHP code by providing crafted template strings.
CVE-2025-25174CVSS 10Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in beeteam368 BeeTeam368 Extensions beeteam368-extensions allows PHP Local File Inclusion.This issue affects BeeTeam368 Extensions: from n/a through <= 1.9.4.
CVE-2025-62521CVSS 10ChurchCRM is an open-source church management system. Prior to version 5.21.0, a pre-authentication remote code execution vulnerability in ChurchCRM's setup wizard allows unauthenticated attackers to inject arbitrary PHP code during the initial installation process, leading to complete server compromise. The vulnerability exists in `setup/routes/setup.php` where user input from the setup form is directly concatenated into a PHP configuration template without any validation or sanitization. Any parameter in the setup form can be used to inject PHP code that gets written to `Include/Config.php`, which is then executed on every page load. This is more severe than typical authenticated RCE vulnerabilities because it requires no credentials and affects the installation process that administrators must complete. Version 5.21.0 patches the issue.

References

Track CVEs across your fleet automatically

Defensia scans your Linux servers and tells you exactly which ones are running vulnerable versions — including CVE-2026-59942. Free for 1 server.

Get started free