CVE-2026-55555: Dompdf File Existence Oracle Vulnerability Leading to Memory Exhaustion
Summary
CVE-2026-55555: Dompdf: File existence oracle via font-face stylesheet declaration. Affects dompdf/dompdf versions < 3.1.6. Fixed in 3.1.6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Dompdf is a popular PHP library that converts HTML to PDF documents. It is widely used in web applications to generate PDF files dynamically from user-provided content. The library supports various features, including CSS styling and font embedding. However, it is vulnerable to a File Existence Oracle attack, which can be exploited if user input is not properly sanitized.
Vulnerability Detail
The vulnerability arises from the manipulation of the CSS @font-face directive in Dompdf. An attacker can craft malicious HTML that references local files using the file:// protocol. When the file exists, Dompdf attempts to process it multiple times, leading to a memory exhaustion error. Conversely, if the file does not exist, the rendering engine fails quickly, allowing the attacker to infer the existence of sensitive files on the server. This discrepancy can lead to information disclosure, enabling attackers to enumerate sensitive files like .env files or SSH keys.
How To Fix
Minimum fixed version
3.1.6
This is the first release that contains the fix.
composer require dompdf/dompdf:3.1.6Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, restrict user input by validating and sanitizing HTML content before processing it with Dompdf. Implementing a whitelist of allowed HTML tags and attributes can help mitigate the risk of exploitation.
Conclusion
The Dompdf vulnerability CVE-2026-55555 poses a significant risk of information disclosure through a File Existence Oracle attack. It is crucial to update to the patched version and implement proper input sanitization to protect your application from potential exploitation.
See every vulnerability recorded for dompdf/dompdf →
FAQ
A File Existence Oracle attack allows an attacker to determine whether specific files exist on a server by observing the application's behavior when attempting to access those files.
If your application uses Dompdf and allows users to submit raw HTML without proper sanitization, it may be vulnerable to this attack. You can check for vulnerabilities using tools like Vulert.
The primary impact is information disclosure, where an attacker can confirm the existence of sensitive files on the server, potentially leading to further exploitation.
Yes, you can mitigate the risk by sanitizing user input and restricting the types of HTML that can be processed by Dompdf.
Vulert is a tool that monitors and alerts for open-source vulnerabilities in your software using the composer.lock file. You can check if your application is affected by this vulnerability using the Vulert playground without any signup.
References
Related vulnerabilities
Recent vulnerabilities recorded for dompdf/dompdf.
