Dompdf @font-face File Existence Oracle and DoS via Font Declaration (CVE-2026-55555)

Vulnerability Overview Vulnerability Name: File existence oracle via font-face stylesheet declaration CVE ID: CVE-2026-55555 CVSS v4 base metrics: Attack Vector: Network Attack Complexity: Low Attack Requirements: Present Privileges Required: None User Interaction: None Vulnerable System Impact Metrics: - Confidentiality: Low - Integrity: None - Availability: None Subsequent System Impact Metrics: - Confidentiality: None - Integrity: None - Availability: None Description: Dompdf contains a file existence oracle vulnerability exploited through manipulation of the CSS directive. By supplying malicious HTML referencing local files, an attacker can trigger PHP memory exhaustion. The critical distinction lies in system behavior: 1. If the file exists, Dompdf repeatedly attempts to process the local resource, leading to an "Allowed memory size exhausted" error and a crash. 2. If the file does not exist, the rendering engine quickly ignores the import, and the memory limit is not reached. This behavioral difference allows attackers to enumerate sensitive files on the server, regardless of (OROOT) restrictions. Affected Versions Affected Versions: <=3.1.5 Fixed Versions: 3.1.6 Package: dompdf/dompdf (Composer) Remediation Upgrade to dompdf version 3.1.6 or later. Example Scenarios 1. Vulnerable System A web application provides a public mechanism for generating PDFs based on user-supplied content. The application accepts raw HTML input or renders user-provided content without sanitization or validation, using Dompdf for processing. Vulnerable Endpoint: Vulnerable Parameter: (POST) Simplified code: 2. Attack Generation An attacker runs a script on their machine to generate a significant payload. This payload is subsequently sent to the victim's public endpoint via a standard HTTP POST request. Attacker's local script ( ): 3. Exploitation The attacker sends the malicious HTML to the remote server via a curl request: By analyzing the generated file (via size or error responses), a remote attacker can confirm the existence of the file without direct server access. When the file reference is valid and execution parameters are met, Dompdf overflows the PHP memory limit and hangs/crashes. File Exists: File Does Not Exist: Note: The specific number of iterations required to trigger the overflow varies by system. This is based on the memory limits imposed on the target system and internal PHP factors related to memory management (heap allocation and garbage collection). In most cases, there appears to be no significant difference in memory usage until a certain number of file operations occur, at which point the memory limit is breached only when the file exists. Impact Information Disclosure (File Oracle via Reflected HTML): In scenarios where an attacker can control the reflected HTML, they can systematically map the server's file system by observing whether the application returns a memory exhaustion error (file exists) or renders normally (file does not exist). References CWE-770: Allocation of Resources Without Limits or Throttling Dompdf Repository

Goal Reached Thanks to every supporter — we hit 100%!

Dompdf @font-face File Existence Oracle and DoS via Font Declaration (CVE-2026-55555)

More from this source