CVE-2026-45742: Gotenberg Denial of Service Vulnerability

CVE-2026-45742 Overview

CVE-2026-45742 is a concurrency vulnerability in Gotenberg, a Docker-powered stateless API for PDF file generation. The flaw affects versions from 8.10.0 up to but not including 8.33.0. The newContext function in pkg/modules/api/context.go spawns one errgroup.Go goroutine per multipart downloadFrom entry. These goroutines concurrently write to shared maps and slices without synchronization. Go maps and slices are not safe for concurrent mutation, triggering a fatal runtime error that terminates the process. The default configuration enables downloadFrom and disables authentication, exposing the endpoint to unauthenticated remote attackers.

Critical Impact
An unauthenticated remote attacker can crash exposed Gotenberg conversion services by sending a crafted multipart request with multiple downloadFrom entries, causing denial of service.

Affected Products

Gotenberg versions 8.10.0 through 8.32.x
Docker deployments running default Gotenberg configuration
Gotenberg instances with downloadFrom feature enabled and authentication disabled

Discovery Timeline

2026-08-19 - CVE-2026-45742 published to NVD
2026-08-19 - Last updated in NVD database
Fix released - Gotenberg version 8.33.0 addresses the vulnerability

Technical Details for CVE-2026-45742

Vulnerability Analysis

The vulnerability is a data race classified as [CWE-362]. The newContext function processes multipart downloadFrom entries by spawning concurrent goroutines through errgroup.Go. Each goroutine writes downloaded file metadata to three shared structures: ctx.files, ctx.diskToOriginal, and ctx.filesByField.

Go's runtime detects concurrent map writes and aborts the process with a fatal error. Unlike a recoverable panic, this fatal error cannot be caught with recover() and terminates the entire Gotenberg service. An attacker submitting a multipart request with many downloadFrom entries reliably triggers this race condition.

Root Cause

The root cause is missing synchronization when multiple goroutines mutate shared data structures. Go maps require external synchronization such as sync.Mutex or sync.RWMutex for concurrent write access. The affected code path violates this contract by allowing parallel writes without any locking or channel-based coordination.

Attack Vector

The attack requires no authentication because Gotenberg's default configuration disables authentication and enables the downloadFrom feature. An attacker sends a single crafted HTTP multipart POST request containing multiple downloadFrom URL entries. The parallel goroutine execution triggers concurrent writes to the shared maps, crashing the service.

			)
		}

		// Each goroutine writes to its own results slot. The main
		// goroutine merges into ctx.files, ctx.diskToOriginal, and
		// ctx.filesByField after eg.Wait() to avoid concurrent map
		// writes.
		type downloadFromResult struct {
			filename, path, formField string
		}
		results := make([]downloadFromResult, len(dls))

		eg, _ := errgroup.WithContext(ctx)
		for i, dl := range dls {
			eg.Go(func() error {

Source: Gotenberg security patch commit. The patch introduces a per-goroutine results slice indexed by position, then merges results serially in the main goroutine after eg.Wait().

Detection Methods for CVE-2026-45742

Indicators of Compromise

Sudden Gotenberg process termination with log entries containing fatal error: concurrent map writes
Repeated container restarts or crash loops in orchestrated Gotenberg deployments
Incoming multipart HTTP POST requests with unusually high numbers of downloadFrom fields from a single source

Detection Strategies

Monitor Gotenberg container stdout and stderr for Go runtime fatal errors referencing concurrent map writes
Deploy request-rate and payload-shape analysis at the reverse proxy layer to flag multipart requests with abnormal downloadFrom entry counts
Track Gotenberg service uptime and restart frequency through container orchestration metrics

Monitoring Recommendations

Alert on Kubernetes pod restart counts or Docker container exit events for Gotenberg workloads
Log all inbound requests to /forms/chromium/convert/url and related conversion endpoints for post-incident analysis
Correlate crash events with source IP addresses to identify probing or exploitation attempts

How to Mitigate CVE-2026-45742

Immediate Actions Required

Upgrade Gotenberg to version 8.33.0 or later, which serializes downloadFrom result merging
Enable authentication on all exposed Gotenberg instances to restrict access to trusted clients
Restrict network exposure of Gotenberg endpoints to internal networks or authenticated API gateways

Patch Information

Gotenberg version 8.33.0 fixes the vulnerability by allocating a per-goroutine results slice and merging entries into ctx.files, ctx.diskToOriginal, and ctx.filesByField serially after eg.Wait() completes. See the Gotenberg v8.33.0 release notes and GHSA-vp73-vjw8-8f32 advisory for full details.

Workarounds

Disable the downloadFrom feature if not required by application workflows
Place Gotenberg behind an authenticated reverse proxy that enforces request validation and rate limiting
Limit the maximum number of downloadFrom entries per request at the proxy layer until patching is complete

bash

# Upgrade Gotenberg Docker image to patched version
docker pull gotenberg/gotenberg:8.33.0
docker stop gotenberg && docker rm gotenberg
docker run -d --name gotenberg \
  -p 3000:3000 \
  gotenberg/gotenberg:8.33.0 \
  gotenberg --api-enable-basic-auth=true