CVE-2026-35458: Gotenberg API DoS Vulnerability

CVE-2026-35458 Overview

CVE-2026-35458 is a Regular Expression Denial of Service (ReDoS) vulnerability affecting Gotenberg, a popular API service for converting document formats. The vulnerability exists in versions 8.29.1 and earlier, where the application uses the dlclark/regexp2 library to compile user-supplied scope patterns without implementing a proper timeout mechanism. Attackers with access to features utilizing this logic can craft malicious regular expression patterns that cause worker processes to hang indefinitely, resulting in service unavailability.

Critical Impact

Unauthenticated remote attackers can exploit this vulnerability via network-accessible Gotenberg instances to cause indefinite worker hangs, leading to complete denial of service for document conversion operations.

Affected Products

• Gotenberg versions 8.29.1 and earlier
• Any systems running Gotenberg API with exposed document conversion features
• Deployments using the dlclark/regexp2 library for user-supplied pattern compilation

Discovery Timeline

• 2026-04-07 - CVE CVE-2026-35458 published to NVD
• 2026-04-09 - Last updated in NVD database

Technical Details for CVE-2026-35458

Vulnerability Analysis

This vulnerability is classified under CWE-1333 (Inefficient Regular Expression Complexity), commonly known as ReDoS (Regular Expression Denial of Service). The flaw stems from Gotenberg's use of the dlclark/regexp2 library for processing user-provided scope patterns without establishing execution time limits.

Regular expressions with certain patterns can exhibit exponential time complexity when processing specific input strings. When Gotenberg compiles and executes user-controlled regular expressions without timeout constraints, an attacker can submit specially crafted patterns designed to maximize processing time. This causes the worker thread handling the request to become unresponsive indefinitely.

The network-accessible nature of the vulnerability means that unauthenticated attackers can reach the vulnerable code path remotely. The attack requires no special privileges or user interaction, and it specifically targets availability by exhausting worker resources.

Root Cause

The root cause is the absence of timeout configuration when using the dlclark/regexp2 library to compile and execute user-supplied regular expression patterns. The library supports timeout functionality, but Gotenberg versions 8.29.1 and earlier fail to configure these protective timeouts, allowing malicious patterns to execute without bounds.

Attack Vector

The attack vector is network-based with low complexity requirements. An attacker identifies a Gotenberg instance exposed to the network and submits requests containing maliciously crafted regular expression patterns to features that process user-defined scope patterns. The crafted pattern is designed to cause catastrophic backtracking or exponential time complexity during regex evaluation.

When the vulnerable code attempts to compile and execute the malicious pattern, the worker process enters an indefinite processing state. By sending multiple such requests, an attacker can exhaust all available worker processes, rendering the Gotenberg service completely unresponsive to legitimate requests.

The vulnerability mechanism involves crafting regex patterns that exploit backtracking behavior. Patterns with nested quantifiers like (a+)+, alternation combined with repetition like (a|a)*, or overlapping character classes can cause the regex engine to explore an exponentially growing number of matching paths. Without a timeout, this exploration continues indefinitely.

For detailed technical information, see the GitHub Security Advisory.

Detection Methods for CVE-2026-35458

Indicators of Compromise

• Gotenberg worker processes consuming 100% CPU for extended periods without completing requests
• Increasing queue of pending document conversion requests with no processing progress
• Worker threads stuck in regex compilation or matching operations
• Service timeouts reported by clients while server-side processes remain active

Detection Strategies

• Monitor Gotenberg worker process CPU utilization for sustained high usage patterns
• Implement request logging to capture incoming scope patterns for pattern analysis
• Set up alerts for worker thread states showing extended processing times
• Review access logs for unusual or abnormally long scope pattern submissions

Monitoring Recommendations

• Configure application-level monitoring to track worker availability and response times
• Establish baseline metrics for normal regex processing duration and alert on deviations
• Implement health check endpoints that verify worker responsiveness
• Monitor container or process resource limits to detect resource exhaustion attacks

How to Mitigate CVE-2026-35458

Immediate Actions Required

• Upgrade Gotenberg to a patched version that implements proper regex timeout handling
• Implement network-level access controls to restrict Gotenberg access to trusted clients only
• Configure reverse proxy timeouts to terminate long-running requests
• Review and restrict access to features that process user-supplied scope patterns

Patch Information

A security fix has been released to address this vulnerability. Refer to the GitHub Security Advisory for specific patched version information and upgrade instructions.

Organizations should prioritize upgrading Gotenberg installations to the latest available version that includes timeout protections for regex operations.

Workarounds

• Deploy a reverse proxy with request timeout configurations to terminate requests exceeding reasonable processing times
• Implement network segmentation to limit Gotenberg exposure to internal or trusted networks only
• Apply input validation at the application layer to restrict scope pattern complexity before reaching Gotenberg
• Use containerization with resource limits to prevent a single hung worker from affecting the entire system

# Example: Configure nginx reverse proxy timeout to mitigate indefinite hangs
location /gotenberg/ {
    proxy_pass http://gotenberg:3000/;
    proxy_connect_timeout 30s;
    proxy_send_timeout 60s;
    proxy_read_timeout 60s;
    send_timeout 60s;
}