CVE-2026-59941: Dompdf uncontrolled resource consumption in BMP processing

CVE-2026-59941 · Severity: medium · CVSS 4 · Published 2026-07-28

Dompdf, a popular library for converting HTML to PDF documents, is vulnerable to a denial-of-service attack. An attacker can send a specially crafted, very small image file that tricks the server into allocating massive amounts of memory and processing power. This can cause the server to crash or become unresponsive, preventing legitimate users from generating documents like invoices or reports.

Technologies: Dompdf, dompdf/dompdf (Packagist). Vendors: Dompdf, Packagist.

Quick answers

Is CVE-2026-59941 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-59941 being exploited in the wild.
How severe is CVE-2026-59941?
Medium severity, with a CVSS score of 4, published 28 July 2026.
Which products and versions are affected?
Dompdf < 3.1.6; dompdf/dompdf (Packagist) < 3.1.6, ECOSYSTEM:introduced=0,fixed=3.1.6.
Is there a fix for CVE-2026-59941?
Yes. dompdf/dompdf (Packagist): upgrade to 3.1.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-59941 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-59941?
Check whether you run Dompdf or dompdf/dompdf (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • dompdf/dompdf (Packagist): upgrade to 3.1.6 or later
    composer require dompdf/dompdf:^3.1.6

Technical details

Dompdf versions prior to 3.1.6 are vulnerable to resource exhaustion (CWE-400) during BMP image processing. The library trusts the width and height dimensions declared in a BMP file header without validating them against the actual file size or a maximum pixel budget. When an attacker provides a crafted BMP (which can be inlined as a data URI in HTML), the underlying PHP GD extension attempts to allocate a full pixel canvas based on these dimensions. Because this allocation occurs in the GD native allocator, it often bypasses PHP's 'memory_limit' restrictions. A small 169-byte request can trigger hundreds of megabytes of memory allocation and significant CPU usage, allowing unauthenticated attackers to exhaust server resources and cause a Denial of Service. This issue is resolved in version 3.1.6.

Affected products

  • dompdf dompdf < 3.1.6

Identifiers

  • CVE-2026-59941
  • GHSA-8hg6-c449-896m

Timeline

  • 2026-07-20: patched: Fixed in version 3.1.6
  • 2026-07-28: disclosed: Public advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.