Is CVE-2026-59942 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-59942 being exploited in the wild.

How severe is CVE-2026-59942?

Medium severity, with a CVSS score of 4, published 28 July 2026.

Which products and versions are affected?

Dompdf < 3.1.6, <= 3.1.5; dompdf/dompdf (Packagist) < 3.1.6, ECOSYSTEM:introduced=0,fixed=3.1.6.

Is there a fix for CVE-2026-59942?

Yes. dompdf/dompdf (Packagist): upgrade to 3.1.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-59942 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-59942?

Check whether you run Dompdf or dompdf/dompdf (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-59942: Dompdf resource exhaustion Denial of Service via oversized images

Q: Which products and versions are affected?

Dompdf < 3.1.6, <= 3.1.5; dompdf/dompdf (Packagist) < 3.1.6, ECOSYSTEM:introduced=0,fixed=3.1.6.

Q: Is there a fix for CVE-2026-59942?

Yes. dompdf/dompdf (Packagist): upgrade to 3.1.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-59942 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-59942?

Check whether you run Dompdf or dompdf/dompdf (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-59942 · Severity: medium · CVSS 4 · Published 2026-07-28

Dompdf, a popular PHP library used to convert HTML documents into PDF files, is vulnerable to a Denial of Service (DoS) attack. By submitting a specially crafted HTML document containing a high-resolution, high-entropy image (such as random noise), an attacker can force the server to consume excessive CPU and memory. This can lead to the web server crashing or becoming unresponsive, preventing legitimate users from accessing the service.

Technologies: Dompdf, dompdf/dompdf (Packagist). Vendors: Dompdf, Packagist.

Quick answers

Is CVE-2026-59942 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-59942 being exploited in the wild.
How severe is CVE-2026-59942?: Medium severity, with a CVSS score of 4, published 28 July 2026.
Which products and versions are affected?: Dompdf < 3.1.6, <= 3.1.5; dompdf/dompdf (Packagist) < 3.1.6, ECOSYSTEM:introduced=0,fixed=3.1.6.
Is there a fix for CVE-2026-59942?: Yes. dompdf/dompdf (Packagist): upgrade to 3.1.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-59942 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-59942?: Check whether you run Dompdf or dompdf/dompdf (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

dompdf/dompdf (Packagist): upgrade to 3.1.6 or later
```
composer require dompdf/dompdf:^3.1.6
```

Technical details

A resource exhaustion vulnerability exists in Dompdf's rendering engine due to improper validation of cumulative resource consumption for large bitmap images. While the library performs early dimension checks, these can be bypassed using high-entropy (random noise) Base64-encoded images wrapped in specific CSS containers. During the rendering phase, the engine attempts to decompress and calculate bounding boxes for the uncompressed bitmap in memory, leading to 100% CPU saturation and massive memory allocation (e.g., ~1.2 GB for a 30,000x30,000 pixel image). This results in a PHP Fatal Error or OS-level process termination (OOM). The issue is fixed in version 3.1.6 by implementing byte-size limits on images.

Affected products

dompdf dompdf <= 3.1.5

Identifiers

CVE-2026-59942
GHSA-f5gf-2cj8-52g2

Timeline

2026-07-20: patched: Fixed in version 3.1.6
2026-07-28: advisory: NVD and GitHub advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.