CVE-2014-5012: DOMPDF Denial of Service Vulnerability
Summary
CVE-2014-5012: DOMPDF denial of service vulnerability. Affects dompdf/dompdf versions >= 0.6, < 0.6.2. Fixed in 0.6.2. How to fix ↓
Also tracked for
- php-dompdf · Debian:11
The same CVE-2014-5012 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
DOMPDF is a PHP library that allows users to generate PDF files from HTML content. It is commonly used in web applications to dynamically create and serve PDF documents. The library provides various features for styling and formatting the PDF output, making it a popular choice for developers. However, versions prior to 0.6.2 are vulnerable to a denial of service (DoS) attack.
Vulnerability Detail
The vulnerability in DOMPDF before version 0.6.2 allows an attacker to trigger a DoS attack. This can be exploited by sending specially crafted input to the library, causing it to consume excessive resources and potentially crash. The impact of this vulnerability can range from temporary unavailability of the affected application to a complete system outage. It is important to note that this vulnerability does not allow remote code execution or unauthorized access to sensitive information.
How To Fix
Minimum fixed version
0.6.2
This is the first release that contains the fix.
composer require dompdf/dompdf:0.6.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating the DOMPDF library is not immediately feasible, a temporary workaround can be implemented to mitigate the risk of exploitation. One possible workaround is to implement rate limiting or request throttling mechanisms to restrict the number of PDF generation requests that can be processed within a given time frame. This can help prevent resource exhaustion and minimize the impact of a potential DoS attack. However, it is important to note that workarounds are not a substitute for applying the official fix and should only be considered as a temporary measure.
Conclusion
In conclusion, the DOMPDF library before version 0.6.2 is vulnerable to a denial of service attack. To mitigate this vulnerability, it is crucial to update the library to the latest version. Additionally, implementing rate limiting or request throttling mechanisms can provide temporary protection. For further assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for dompdf/dompdf →
FAQ
DOMPDF is a PHP library that allows users to generate PDF files from HTML content. It is commonly used in web applications for dynamically creating and serving PDF documents.
A denial of service (DoS) attack is a malicious attempt to disrupt the normal functioning of a system or network by overwhelming it with a flood of illegitimate requests or excessive resource consumption.
The impact of this vulnerability can range from temporary unavailability of the affected application to a complete system outage. However, it does not allow remote code execution or unauthorized access to sensitive information.
To fix this vulnerability, update the DOMPDF library to version 0.6.2 or later. Update the package dependency in your project's composer.json file and run the composer update command.
If updating the library is not immediately feasible, you can implement rate limiting or request throttling mechanisms to restrict the number of PDF generation requests within a given time frame.
References
Related vulnerabilities
Recent vulnerabilities recorded for dompdf/dompdf.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
