CRITICALCVE-2026-35458Published Modified CNA GitHub_M
CVE-2026-35458: Gotenberg has a ReDoS via extraHttpHeaders scope feature
Gotenberg is an API for converting document formats. In 8.29.1 and earlier, Gotenberg uses dlclark/regexp2 to compile user-supplied scope patterns without setting a proper timeout. Users with access to features using this logic can hang workers indefinitely.
Metrics
- CVSS v3.1
- 9.8
- Severity
- CRITICAL
- Fixed in
- —
- Affected Products
- 1
Affected packages
- gotenberg / gotenberg<= 8.29.1
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H