Skip to content
CVE PROGRAM SOURCE RECORD8.7 High

CVE-2026-35458

Gotenberg has a ReDoS via extraHttpHeaders scope feature

Description

Gotenberg is an API for converting document formats. In 8.29.1 and earlier, Gotenberg uses dlclark/regexp2 to compile user-supplied scope patterns without setting a proper timeout. Users with access to features using this logic can hang workers indefinitely.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

gotenberg gotenberg

  • <= 8.29.1affected

References