dompdf vulnerabilities

CVEs per yearBy the year they were published

1. 20222
2. 20235
3. 20243
4. 20266

Newest CVEs

• CVE-2026-59941

  Dompdf: Uncontrolled resource consumption based on declared BMP dimensions

  dompdf · dompdf

  Medium6.3
• CVE-2026-59942

  Dompdf: Denial of Service (DoS) via Resource Exhaustion using Oversized Image Bitmaps

  dompdf · dompdf

  Medium6.3
• CVE-2026-59943

  Dompdf: Embedded SVG images can leak existence of files and directories within the filesystem

  dompdf · dompdf

  Medium6.3
• CVE-2026-56722

  Dompdf: Local file read due to improper file path validation in SVG images encoded as data-URI

  dompdf · dompdf

  Medium6.3
• CVE-2026-55554

  Dompdf: Chroot Validation Bypass

  dompdf · dompdf

  Low2.3
• CVE-2026-55555

  Dompdf: File existence oracle via font-face stylesheet declaration

  dompdf · dompdf

  Low2.3
• CVE-2021-3902

  Improper Restriction of XML External Entity Reference in dompdf/dompdf

  dompdf · dompdf/dompdf

  Critical9.8
• CVE-2021-3838

  PHAR Deserialization in dompdf/dompdf

  dompdf · dompdf/dompdf

  Critical9.8
• CVE-2024-25117

  php-svg-lib lacks path validation on font through SVG inline styles

  dompdf · php-svg-lib

  Medium6.8
• CVE-2023-50262

  Dompdf possible DoS caused by infinite recursion when parsing SVG images

  dompdf · dompdf

  Medium5.3