https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 18:19:33 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-342213 EUVD-2026-342213 https://cve.radiocsirt.org/vuln/euvd-2026-342213 https://cve.radiocsirt.org/vuln/fkie_cve-2026-55555 <p>Dompdf is an HTML to PDF converter for PHP. Versions 3.15 and prior are vulnerable to a File Existence Oracle attack through the manipulation of the CSS @font-face directive. By providing malicious HTML that references local files via the file:// protocol repeatedly, an attacker can trigger PHP memory exhaustion. Because Dompdf behaves differently depending on whether a referenced local file exists (an existing file is processed repeatedly until it triggers an &#34;Allowed memory size exhausted&#34; crash, whereas a missing file fails fast or is ignored and never hits the memory limit), an attacker can use this observable discrepancy as an oracle to enumerate sensitive files on the server regardless of CHROOT restrictions. Exploitation requires the attacker to supply unrestricted or unsanitized HTML in a request that permits large data, plus a configuration where Dompdf&#39;s memory limit is low enough to be exhausted (with  $_dompdf_show_warnings=true  making the overflow easier to reach). This issue has been fixed in version 3.16.</p> <p>Dompdf is an HTML to PDF converter for PHP. Versions 3.15 and prior are vulnerable to a File Existence Oracle attack through the manipulation of the CSS @font-face directive. By providing malicious HTML that references local files via the file:// protocol repeatedly, an attacker can trigger PHP memory exhaustion. Because Dompdf behaves differently depending on whether a referenced local file exists (an existing file is processed repeatedly until it triggers an &#34;Allowed memory size exhausted&#34; crash, whereas a missing file fails fast or is ignored and never hits the memory limit), an attacker can use this observable discrepancy as an oracle to enumerate sensitive files on the server regardless of CHROOT restrictions. Exploitation requires the attacker to supply unrestricted or unsanitized HTML in a request that permits large data, plus a configuration where Dompdf&#39;s memory limit is low enough to be exhausted (with  $_dompdf_show_warnings=true  making the overflow easier to reach). This issue has been fixed in version 3.16.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-55555 https://cve.radiocsirt.org/vuln/ghsa-7x2p-4jvh-6384 <p><strong>Affected:</strong> Packagist: dompdf/dompdf</p> <p>## Description</p> <p>Dompdf is vulnerable to a **File Existence Oracle** attack through the manipulation of the CSS `@font-face` directive. By providing malicious HTML that references local files via the `file://` protocol repeatedly, an attacker can trigger PHP memory exhaustion.</p> <p>The critical point of this flaw is the discrepancy in system behavior:</p> <p>1. **If the file exists:** Dompdf attempts to process the local resource multiple times, leading to an &#34;Allowed memory size exhausted&#34; error, which crashes the creation. 2. **If the file does NOT exist:** The rendering engine fails quickly or ignores the import, and the memory limit is not reached.</p> <p>This discrepancy allows an attacker to enumerate sensitive files on the server, regardless of `CHROOT` restrictions.</p> <p>Some factors impact the ability of attackers to exploit the vulnerability: - The attacker must be allowed to provide unrestricted and/or unsanitized HTML content. - System parameters must be configured in such a way that Dompdf is able to generate a memory overflow error. - HTTP GET querystring or POST body must allow large data - Memory limits must be low enough that Dompdf can trigger an overflow - `$_dompdf_show_warnings` when set to true can bump memory usage</p> <p>---</p> <p>## Example Scenario</p> <p>### 1. Vulnerable System</p> <p>A web application provides a public mechanism for generating a PDF based on user supplied content. The application accepts raw HTML input or renders user-supplied content without sanitation or validation…</p> <p><strong>Affected:</strong> Packagist: dompdf/dompdf</p> <p>## Description</p> <p>Dompdf is vulnerable to a **File Existence Oracle** attack through the manipulation of the CSS `@font-face` directive. By providing malicious HTML that references local files via the `file://` protocol repeatedly, an attacker can trigger PHP memory exhaustion.</p> <p>The critical point of this flaw is the discrepancy in system behavior:</p> <p>1. **If the file exists:** Dompdf attempts to process the local resource multiple times, leading to an &#34;Allowed memory size exhausted&#34; error, which crashes the creation. 2. **If the file does NOT exist:** The rendering engine fails quickly or ignores the import, and the memory limit is not reached.</p> <p>This discrepancy allows an attacker to enumerate sensitive files on the server, regardless of `CHROOT` restrictions.</p> <p>Some factors impact the ability of attackers to exploit the vulnerability: - The attacker must be allowed to provide unrestricted and/or unsanitized HTML content. - System parameters must be configured in such a way that Dompdf is able to generate a memory overflow error. - HTTP GET querystring or POST body must allow large data - Memory limits must be low enough that Dompdf can trigger an overflow - `$_dompdf_show_warnings` when set to true can bump memory usage</p> <p>---</p> <p>## Example Scenario</p> <p>### 1. Vulnerable System</p> <p>A web application provides a public mechanism for generating a PDF based on user supplied content. The application accepts raw HTML input or renders user-supplied content without sanitation or validation…</p> https://cve.radiocsirt.org/vuln/ghsa-7x2p-4jvh-6384 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-55555 <p><strong>Affected:</strong> Ubuntu:Pro:16.04:LTS: php-dompdf, Ubuntu:Pro:18.04:LTS: php-dompdf, Ubuntu:20.04:LTS: php-dompdf, Ubuntu:22.04:LTS: php-dompdf</p> <p>Dompdf is an HTML to PDF converter for PHP. Versions 3.15 and prior are vulnerable to a File Existence Oracle attack through the manipulation of the CSS @font-face directive. By providing malicious HTML that references local files via the file:// protocol repeatedly, an attacker can trigger PHP memory exhaustion. Because Dompdf behaves differently depending on whether a referenced local file exists (an existing file is processed repeatedly until it triggers an &#34;Allowed memory size exhausted&#34; crash, whereas a missing file fails fast or is ignored and never hits the memory limit), an attacker can use this observable discrepancy as an oracle to enumerate sensitive files on the server regardless of CHROOT restrictions. Exploitation requires the attacker to supply unrestricted or unsanitized HTML in a request that permits large data, plus a configuration where Dompdf&#39;s memory limit is low enough to be exhausted (with  $_dompdf_show_warnings=true  making the overflow easier to reach). This issue has been fixed in version 3.16.</p> <p><strong>Affected:</strong> Ubuntu:Pro:16.04:LTS: php-dompdf, Ubuntu:Pro:18.04:LTS: php-dompdf, Ubuntu:20.04:LTS: php-dompdf, Ubuntu:22.04:LTS: php-dompdf</p> <p>Dompdf is an HTML to PDF converter for PHP. Versions 3.15 and prior are vulnerable to a File Existence Oracle attack through the manipulation of the CSS @font-face directive. By providing malicious HTML that references local files via the file:// protocol repeatedly, an attacker can trigger PHP memory exhaustion. Because Dompdf behaves differently depending on whether a referenced local file exists (an existing file is processed repeatedly until it triggers an &#34;Allowed memory size exhausted&#34; crash, whereas a missing file fails fast or is ignored and never hits the memory limit), an attacker can use this observable discrepancy as an oracle to enumerate sensitive files on the server regardless of CHROOT restrictions. Exploitation requires the attacker to supply unrestricted or unsanitized HTML in a request that permits large data, plus a configuration where Dompdf&#39;s memory limit is low enough to be exhausted (with  $_dompdf_show_warnings=true  making the overflow easier to reach). This issue has been fixed in version 3.16.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-55555