Executive brief
Dompdf, a popular library for converting HTML to PDF documents, is vulnerable to a denial-of-service attack. An attacker can send a specially crafted, very small image file that tricks the server into allocating massive amounts of memory and processing power. This can cause the server to crash or become unresponsive, preventing legitimate users from generating documents like invoices or reports.
Technical details
Dompdf versions prior to 3.1.6 are vulnerable to resource exhaustion (CWE-400) during BMP image processing. The library trusts the width and height dimensions declared in a BMP file header without validating them against the actual file size or a maximum pixel budget. When an attacker provides a crafted BMP (which can be inlined as a data URI in HTML), the underlying PHP GD extension attempts to allocate a full pixel canvas based on these dimensions. Because this allocation occurs in the GD native allocator, it often bypasses PHP's 'memory_limit' restrictions. A small 169-byte request can trigger hundreds of megabytes of memory allocation and significant CPU usage, allowing unauthenticated attackers to exhaust server resources and cause a Denial of Service. This issue is resolved in version 3.1.6.
Affected products
- dompdf dompdf < 3.1.6
Timeline
- 2026-07-20: patched: Fixed in version 3.1.6
- 2026-07-28: disclosed: Public advisory published