Dompdf

This hub aggregates every CVE we track for Dompdf, a product in the oss libraries space. Use it to gauge the current risk picture and drill into individual advisories.

Severity distribution

Monthly trend

The 15 most recently published vulnerabilities affecting Dompdf.

• CVE-2026-59941Dompdf: Uncontrolled resource consumption based on declared BMP dimensions7.5Jul 28, 2026
• CVE-2026-59942Dompdf: Denial of Service (DoS) via Resource Exhaustion using Oversized Image Bitmaps7.5Jul 28, 2026
• CVE-2026-59943Dompdf: Embedded SVG images can leak existence of files and directories within the filesystem5.3Jul 28, 2026
• CVE-2026-56722Dompdf: Local file read due to improper file path validation in SVG images encoded as data-URI5.3Jul 28, 2026
• CVE-2026-55554Dompdf: Chroot Validation Bypass7.5Jul 28, 2026
• CVE-2026-55555Dompdf: File existence oracle via font-face stylesheet declaration7.5Jul 28, 2026
• CVE-2021-3902Improper Restriction of XML External Entity Reference in dompdf/dompdf9.8Nov 15, 2024
• CVE-2021-3838PHAR Deserialization in dompdf/dompdf9.8Nov 15, 2024
• CVE-2023-50262Dompdf possible DoS caused by infinite recursion when parsing SVG images5.3Dec 13, 2023
• CVE-2023-24813URI validation failure on SVG parsing. Bypass of CVE-2023-2392410.0Feb 7, 2023
• CVE-2023-23924URI validation failure on SVG parsing in Dompdf10.0Jan 31, 2023
• CVE-2022-41343registerFont in FontMetrics.php in Dompdf before 2.0.1 allows remote file inclusion because a URI validation failure does not halt font registration, as demonstrated by a @font-face rule.7.5Sep 25, 2022
• CVE-2022-2400External Control of File Name or Path in dompdf/dompdf5.3Jul 18, 2022
• CVE-2022-0085Server-Side Request Forgery (SSRF) in dompdf/dompdf5.3Jun 28, 2022
• CVE-2022-28368Dompdf 1.2.1 allows remote code execution via a .php file in the src:url field of an @font-face Cascading Style Sheets (CSS) statement (within an HTML input file).9.8Apr 3, 2022