Executive brief
Dompdf, a popular PHP library used to convert HTML documents into PDF files, is vulnerable to a Denial of Service (DoS) attack. By submitting a specially crafted HTML document containing a high-resolution, high-entropy image (such as random noise), an attacker can force the server to consume excessive CPU and memory. This can lead to the web server crashing or becoming unresponsive, preventing legitimate users from accessing the service.
Technical details
A resource exhaustion vulnerability exists in Dompdf's rendering engine due to improper validation of cumulative resource consumption for large bitmap images. While the library performs early dimension checks, these can be bypassed using high-entropy (random noise) Base64-encoded images wrapped in specific CSS containers. During the rendering phase, the engine attempts to decompress and calculate bounding boxes for the uncompressed bitmap in memory, leading to 100% CPU saturation and massive memory allocation (e.g., ~1.2 GB for a 30,000x30,000 pixel image). This results in a PHP Fatal Error or OS-level process termination (OOM). The issue is fixed in version 3.1.6 by implementing byte-size limits on images.
Affected products
- dompdf dompdf <= 3.1.5
Timeline
- 2026-07-20: patched: Fixed in version 3.1.6
- 2026-07-28: advisory: NVD and GitHub advisory published