Dompdf
21 CVEs tracked. None of them is in CISA KEV.
This hub aggregates every CVE we track for Dompdf, a product in the oss libraries space. Use it to gauge the current risk picture and drill into individual advisories.
Dompdf CVEs per month
| Month | CVEs |
|---|---|
| 2024-10 | 0 |
| 2024-11 | 2 |
| 2024-12 | 0 |
| 2025-01 | 0 |
| 2025-02 | 0 |
| 2025-03 | 0 |
| 2025-04 | 0 |
| 2025-05 | 0 |
| 2025-06 | 0 |
| 2025-07 | 0 |
| 2025-08 | 0 |
| 2025-09 | 0 |
| 2025-10 | 0 |
| 2025-11 | 0 |
| 2025-12 | 0 |
| 2026-01 | 0 |
| 2026-02 | 0 |
| 2026-03 | 0 |
| 2026-04 | 0 |
| 2026-05 | 0 |
| 2026-06 | 0 |
| 2026-07 | 6 |
| 2026-08 | 0 |
| 2026-09 | 0 |
Severity
How the 21 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.
- Critical5
- High8
- Medium8
Latest CVEs
The 15 most recently published vulnerabilities affecting Dompdf.
- CVE-2026-59941Dompdf: Uncontrolled resource consumption based on declared BMP dimensions7.5
- CVE-2026-59942Dompdf: Denial of Service (DoS) via Resource Exhaustion using Oversized Image Bitmaps7.5
- CVE-2026-59943Dompdf: Embedded SVG images can leak existence of files and directories within the filesystem5.3
- CVE-2026-56722Dompdf: Local file read due to improper file path validation in SVG images encoded as data-URI5.3
- CVE-2026-55554Dompdf: Chroot Validation Bypass7.5
- CVE-2026-55555Dompdf: File existence oracle via font-face stylesheet declaration7.5
- CVE-2021-3902Improper Restriction of XML External Entity Reference in dompdf/dompdf9.8
- CVE-2021-3838PHAR Deserialization in dompdf/dompdf9.8
- CVE-2023-50262Dompdf possible DoS caused by infinite recursion when parsing SVG images5.3
- CVE-2023-24813URI validation failure on SVG parsing. Bypass of CVE-2023-2392410.0
- CVE-2023-23924URI validation failure on SVG parsing in Dompdf10.0
- CVE-2022-41343registerFont in FontMetrics.php in Dompdf before 2.0.1 allows remote file inclusion because a URI validation failure does not halt font registration, as demonstrated by a @font-face rule.7.5
- CVE-2022-2400External Control of File Name or Path in dompdf/dompdf5.3
- CVE-2022-0085Server-Side Request Forgery (SSRF) in dompdf/dompdf5.3
- CVE-2022-28368Dompdf 1.2.1 allows remote code execution via a .php file in the src:url field of an @font-face Cascading Style Sheets (CSS) statement (within an HTML input file).9.8
Product grouping is registry-driven, with AI assist and human review. How it works