143 lines
6.3 KiB
JSON
143 lines
6.3 KiB
JSON
{
|
||
"dataType": "CVE_RECORD",
|
||
"dataVersion": "5.2",
|
||
"cveMetadata": {
|
||
"cveId": "CVE-2026-59941",
|
||
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
|
||
"state": "PUBLISHED",
|
||
"assignerShortName": "GitHub_M",
|
||
"dateReserved": "2026-07-07T18:20:06.127Z",
|
||
"datePublished": "2026-07-28T20:42:57.010Z",
|
||
"dateUpdated": "2026-07-29T12:41:45.875Z"
|
||
},
|
||
"containers": {
|
||
"cna": {
|
||
"title": "Dompdf: Uncontrolled resource consumption based on declared BMP dimensions",
|
||
"problemTypes": [
|
||
{
|
||
"descriptions": [
|
||
{
|
||
"cweId": "CWE-400",
|
||
"lang": "en",
|
||
"description": "CWE-400: Uncontrolled Resource Consumption",
|
||
"type": "CWE"
|
||
}
|
||
]
|
||
}
|
||
],
|
||
"metrics": [
|
||
{
|
||
"cvssV4_0": {
|
||
"attackVector": "NETWORK",
|
||
"attackComplexity": "LOW",
|
||
"attackRequirements": "PRESENT",
|
||
"privilegesRequired": "NONE",
|
||
"userInteraction": "NONE",
|
||
"vulnConfidentialityImpact": "NONE",
|
||
"vulnIntegrityImpact": "NONE",
|
||
"vulnAvailabilityImpact": "LOW",
|
||
"subConfidentialityImpact": "NONE",
|
||
"subIntegrityImpact": "NONE",
|
||
"subAvailabilityImpact": "NONE",
|
||
"baseScore": 6.3,
|
||
"baseSeverity": "MEDIUM",
|
||
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
|
||
"version": "4.0"
|
||
}
|
||
}
|
||
],
|
||
"references": [
|
||
{
|
||
"name": "https://github.com/dompdf/dompdf/security/advisories/GHSA-8hg6-c449-896m",
|
||
"tags": [
|
||
"x_refsource_CONFIRM"
|
||
],
|
||
"url": "https://github.com/dompdf/dompdf/security/advisories/GHSA-8hg6-c449-896m"
|
||
},
|
||
{
|
||
"name": "https://github.com/dompdf/dompdf/commit/7c65e7bbeccf146b2409740405af73949ad129d0",
|
||
"tags": [
|
||
"x_refsource_MISC"
|
||
],
|
||
"url": "https://github.com/dompdf/dompdf/commit/7c65e7bbeccf146b2409740405af73949ad129d0"
|
||
},
|
||
{
|
||
"name": "https://github.com/dompdf/dompdf/releases/tag/v3.1.6",
|
||
"tags": [
|
||
"x_refsource_MISC"
|
||
],
|
||
"url": "https://github.com/dompdf/dompdf/releases/tag/v3.1.6"
|
||
}
|
||
],
|
||
"affected": [
|
||
{
|
||
"vendor": "dompdf",
|
||
"product": "dompdf",
|
||
"versions": [
|
||
{
|
||
"version": "< 3.1.6",
|
||
"status": "affected"
|
||
}
|
||
]
|
||
}
|
||
],
|
||
"providerMetadata": {
|
||
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
|
||
"shortName": "GitHub_M",
|
||
"dateUpdated": "2026-07-28T20:42:57.010Z"
|
||
},
|
||
"descriptions": [
|
||
{
|
||
"lang": "en",
|
||
"value": "Dompdf is an HTML to PDF converter for PHP. Versions 3.15 and prior accept a BMP image and generates a PDF-compatible PNG based only on its declared header dimensions and never bounds width × height before the image is converted through GD. A 58-byte BMP whose header declares e.g. 6000×6000 is accepted and later drives imagecreatetruecolor($width, $height) (and PHP's native BMP decoder) to allocate the full pixel canvas. A payload can fit in a single HTTP request: the BMP can be inlined as a data:image/bmp;base64,… URI inside attacker-controlled HTML, so no upload, no remote fetch, and no chroot-reachable file is required. I measured a 169-byte request driving a dompdf render to ~412 MB peak RSS and ~4.8 s of CPU/wall time, versus ~34 MB for an identically-sized benign request — roughly a 12× memory amplification per request, repeatable and unauthenticated. This issue has been fixed in version 3.16."
|
||
}
|
||
],
|
||
"source": {
|
||
"advisory": "GHSA-8hg6-c449-896m",
|
||
"discovery": "UNKNOWN"
|
||
}
|
||
},
|
||
"adp": [
|
||
{
|
||
"references": [
|
||
{
|
||
"url": "https://github.com/dompdf/dompdf/security/advisories/GHSA-8hg6-c449-896m",
|
||
"tags": [
|
||
"exploit"
|
||
]
|
||
}
|
||
],
|
||
"metrics": [
|
||
{
|
||
"other": {
|
||
"type": "ssvc",
|
||
"content": {
|
||
"timestamp": "2026-07-29T12:41:13.459265Z",
|
||
"id": "CVE-2026-59941",
|
||
"options": [
|
||
{
|
||
"Exploitation": "poc"
|
||
},
|
||
{
|
||
"Automatable": "no"
|
||
},
|
||
{
|
||
"Technical Impact": "partial"
|
||
}
|
||
],
|
||
"role": "CISA Coordinator",
|
||
"version": "2.0.3"
|
||
}
|
||
}
|
||
}
|
||
],
|
||
"title": "CISA ADP Vulnrichment",
|
||
"providerMetadata": {
|
||
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||
"shortName": "CISA-ADP",
|
||
"dateUpdated": "2026-07-29T12:41:45.875Z"
|
||
}
|
||
}
|
||
]
|
||
}
|
||
} |