CVE-2026-42594 Details
Description
Gotenberg is a Docker-powered stateless API for PDF files. Prior to 8.32.0, the webhook middleware spawns a goroutine that holds a reference to the request's echo.Context after the synchronous handler returns ErrAsyncProcess and Echo recycles the context back to its sync.Pool. When a concurrent request claims the recycled context, c.Reset() clears the store. If the webhook goroutine reaches hardTimeoutMiddleware at that moment, an unchecked type assertion on a nil store entry panics outside any recover() scope, crashing the Gotenberg process. Any anonymous caller reaches the webhook path (default webhook-deny-list filters only the webhook destination, not the submitter). A single-source stress of ~24 webhook requests plus ~60 GET /version requests crashes the process in about two seconds. This vulnerability is fixed in 8.32.0.
A denial-of-service vulnerability has been identified in Gotenberg, a Docker-based API for PDF processing, affecting versions through 8.31.0. The issue arises in the webhook middleware, where an asynchronous goroutine retains a reference to the request's echo.Context. This occurs after the synchronous handler returns an indication for asynchronous processing, allowing Echo to recycle the context. When a concurrent request retrieves the recycled context, it clears the associated data store. If the webhook goroutine then encounters a timeout middleware, an unchecked type assertion on a nil store entry causes a panic, crashing the Gotenberg process. This vulnerability can be exploited by any anonymous caller who can access the Gotenberg API, leading to process crashes and disrupted PDF conversions.
Users can upgrade to Gotenberg version 8.32.0 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 16, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/gotenberg/gotenberg/security/advisories/GHSA-r33j-c622-r6qp | CISA-ADP | ExploitMitigationVendor Advisory |
| https://github.com/gotenberg/gotenberg/security/advisories/GHSA-r33j-c622-r6qp | [email protected] | ExploitMitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-362 | Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| thecodingmachine gotenberg | < 8.32.0 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 18, 2026 | Initial Analysis | [email protected] |
| May 16, 2026 | CVE Modified | CISA-ADP |
| May 14, 2026 | New CVE Received | [email protected] |