Bug#1142987: php-dompdf: CVE-2026-55554 CVE-2026-55555 CVE-2026-56722 CVE-2026-59941 CVE-2026-59942 CVE-2026-59943

Source: php-dompdf
Version: 3.1.4+dfsg-2
Severity: grave
Tags: security upstream
Justification: user security hole
X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>

Hi,

The following vulnerabilities were published for php-dompdf.

CVE-2026-55554[0]:
| Dompdf is an HTML to PDF converter for PHP. In versions 3.15 and
| prior, the validateLocalUri() method enforces chroot boundaries with
| a strpos() prefix check after normalizing paths with  realpath() .
| Because normalization strips the trailing directory separator from
|  $chrootPath , the check only verifies that  $chrootPath  is a
| string prefix of $realfile, so a chroot of  /var/www  also matches
| sibling directories like /var/www2 , /var/www-admin,
| or /var/www_backup. An attacker who controls part of the rendered
| HTML could exploit this to escape the chroot and read sensitive
| files outside the allowed directory. This issue has been fixed in
| version 3.16.


CVE-2026-55555[1]:
| Dompdf is an HTML to PDF converter for PHP. Versions 3.15 and prior
| are vulnerable to a File Existence Oracle attack through the
| manipulation of the CSS @font-face directive. By providing malicious
| HTML that references local files via the file:// protocol
| repeatedly, an attacker can trigger PHP memory exhaustion. Because
| Dompdf behaves differently depending on whether a referenced local
| file exists (an existing file is processed repeatedly until it
| triggers an "Allowed memory size exhausted" crash, whereas a missing
| file fails fast or is ignored and never hits the memory limit), an
| attacker can use this observable discrepancy as an oracle to
| enumerate sensitive files on the server regardless of CHROOT
| restrictions. Exploitation requires the attacker to supply
| unrestricted or unsanitized HTML in a request that permits large
| data, plus a configuration where Dompdf's memory limit is low enough
| to be exhausted (with  $_dompdf_show_warnings=true  making the
| overflow easier to reach). This issue has been fixed in version
| 3.16.


CVE-2026-56722[2]:
| Dompdf is an HTML to PDF converter for PHP. In versions 3.15 and
| prior, aAn attacker who controls the HTML input can bypass this
| restriction by embedding a target file path inside an SVG image
| delivered through a  data:  URI, because dompdf processes the SVG
| twice and the second pass does not enforce the same protections as
| the first. When rendering, dompdf hands the SVG to the separate
|  php-svg-lib  library with external references forced on, and that
| library has no knowledge of the chroot directory, blocks only the
|  phar://  scheme, and ultimately reads the referenced file with no
| path or protocol validation. This lets an external, unauthenticated
| attacker read arbitrary image files from the server's file system in
| the default configuration. This issue has been fixed in version
| 3.16.


CVE-2026-59941[3]:
| Dompdf is an HTML to PDF converter for PHP. Versions 3.15 and prior
| accept a BMP image and generates a PDF-compatible PNG based only on
| its declared header dimensions and never bounds width × height
| before the image is converted through GD. A 58-byte BMP whose header
| declares e.g. 6000×6000 is accepted and later drives
| imagecreatetruecolor($width, $height) (and PHP's native BMP decoder)
| to allocate the full pixel canvas. A payload can fit in a single
| HTTP request: the BMP can be inlined as a data:image/bmp;base64,…
| URI inside attacker-controlled HTML, so no upload, no remote fetch,
| and no chroot-reachable file is required. I measured a 169-byte
| request driving a dompdf render to ~412 MB peak RSS and ~4.8 s of
| CPU/wall time, versus ~34 MB for an identically-sized benign request
| — roughly a 12× memory amplification per request, repeatable and
| unauthenticated. This issue has been fixed in version 3.16.


CVE-2026-59942[4]:
| Dompdf is an HTML to PDF converter for PHP. Versions 3.15 and prior
| are vulnerable to a Denial of Service (DoS) attack via resource
| exhaustion. An attacker can crash the PHP process by providing a
| specially crafted HTML document containing a single image with
| massive dimensions (e.g., 30,000x30,000 pixels). While Dompdf
| implements internal checks to validate image dimensions, these can
| be bypassed by using a high-entropy image (such as random noise)
| encoded in Base64 and wrapped in specific CSS containers. The
| vulnerability exists because the dimension validation happens early,
| but the resource allocation for calculating the object's bounding
| box and internal buffers during the rendering phase does not
| strictly limit the cumulative CPU time or memory usage for a single
| object that has passed the initial check. An unauthenticated remote
| attacker can cause a complete Denial of Service on the web server by
| submitting a crafted HTML string. This affects any application that
| allows users to provide HTML content or URLs that are subsequently
| converted to PDF using Dompdf. This issue has been fixed in version
| 3.16.


CVE-2026-59943[5]:
| Dompdf is an HTML to PDF converter for PHP. In versions 3.15 and
| prior, if a malicious actor can supply unrestricted content for
| rendering by Dompdf they can utilize the SVG rendering functionality
| to leak filesystem information when rendering PDF files using image
| references within a data-URI encoded SVG document. Using an <image>
| element inside a data-URI embedded SVG, an attacker can attempt to
| embed other files via the href or xlink:href attributes. When
| processing a file that does not exist (e.g. file:///DOESNOTEXIST),
| dompdf behaves differently than it does when accessing a file or
| directory that actually exists on the filesystem. This issue has
| been fixed in version 3.16.


If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-55554
    https://www.cve.org/CVERecord?id=CVE-2026-55554
[1] https://security-tracker.debian.org/tracker/CVE-2026-55555
    https://www.cve.org/CVERecord?id=CVE-2026-55555
[2] https://security-tracker.debian.org/tracker/CVE-2026-56722
    https://www.cve.org/CVERecord?id=CVE-2026-56722
[3] https://security-tracker.debian.org/tracker/CVE-2026-59941
    https://www.cve.org/CVERecord?id=CVE-2026-59941
[4] https://security-tracker.debian.org/tracker/CVE-2026-59942
    https://www.cve.org/CVERecord?id=CVE-2026-59942
[5] https://security-tracker.debian.org/tracker/CVE-2026-59943
    https://www.cve.org/CVERecord?id=CVE-2026-59943

Regards,
Salvatore