Reference page — cumulative record through Wednesday, August 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
Dompdf: Uncontrolled resource consumption based on declared BMP dimensions
AV AC AT PR UI VC VI VA CVSS EPSS %ile KEV
N L P N N N N L 6.3 .0063 47.7 —
AFFECTED
Product Versions Fixed
dompdf < 3.1.6 – —
TIMELINE
Jul 7 Reserved by GitHub_M
Jul 28 EXPLOIT PUBLISHED — CVE-2026-59941 (dompdf). Public exploit reference added.
Jul 28 Published (CNA: GitHub_M)
Aug 4 EXPLOIT PUBLISHED — CVE-2026-59941 (dompdf). Public exploit reference added.
Description
Dompdf is an HTML to PDF converter for PHP. Versions 3.15 and prior accept a BMP image and generates a PDF-compatible PNG based only on its declared header dimensions and never bounds width × height before the image is converted through GD. A 58-byte BMP whose header declares e.g. 6000×6000 is accepted and later drives imagecreatetruecolor($width, $height) (and PHP's native BMP decoder) to allocate the full pixel canvas. A payload can fit in a single HTTP request: the BMP can be inlined as a data:image/bmp;base64,… URI inside attacker-controlled HTML, so no upload, no remote fetch, and no chroot-reachable file is required. I measured a 169-byte request driving a dompdf render to ~412 MB peak RSS and ~4.8 s of CPU/wall time, versus ~34 MB for an identically-sized benign request — roughly a 12× memory amplification per request, repeatable and unauthenticated. This issue has been fixed in version 3.16.
Lifecycle
Complete event history — 4 events, chronological
| Date | Event | Detail |
|---|
| July 7, 2026 | Reserved | Reserved by GitHub_M |
| July 28, 2026 | EXPLOIT PUBLISHED | EXPLOIT PUBLISHED — CVE-2026-59941 (dompdf). Public exploit reference added. |
| July 28, 2026 | Published | Published (CNA: GitHub_M) |
| August 4, 2026 | EXPLOIT PUBLISHED | EXPLOIT PUBLISHED — CVE-2026-59941 (dompdf). Public exploit reference added. |
Affected
Affected products and packages — 1 row
| Vendor | Product / Package | Ecosystem | Version introduced | Fixed |
|---|
| dompdf | dompdf | — | < 3.1.6 | — |
About this page
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-59941 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Wednesday, August 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.