Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| dompdf/dompdf | composer | < 3.1.6 | 3.1.6 |
Miggo AIRoot Cause AnalysisThe vulnerability lies in the fact that Dompdf did not properly limit the memory allocated when processing images, particularly high-entropy images with large dimensions. An attacker could craft an HTML document with a specially designed image that would bypass initial dimension checks but would consume an excessive amount of memory during the rendering process, leading to a Denial of Service. The analysis of the patches reveals that the fix involves introducing a new option, imageByteSizeLimit, and modifying several functions to use this limit to check the potential memory consumption of an image before processing it. The key vulnerable functions identified are Dompdf\Image\Cache::resolve_url and Dompdf\Renderer\AbstractRenderer::_background_image, as they were directly involved in processing images without proper memory checks. The function Dompdf\Helpers::dompdf_getimagesize was also modified to provide the necessary memory size information to these functions. The PoC confirms that calling render() triggers the vulnerability, which in turn calls these vulnerable image processing functions.
Dompdf\Image\Cache::resolve_urlsrc/Image/Cache.php
Dompdf\Renderer\AbstractRenderer::_background_imagesrc/Renderer/AbstractRenderer.php
Dompdf\Helpers::dompdf_getimagesizesrc/Helpers.php