CVE-2026-35458
Denial of Service via Regex Timeout in Gotenberg API
Publication date: 2026-04-07
Last updated on: 2026-04-14
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| thecodingmachine | gotenberg | to 8.29.1 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-1333 | The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-35458 is a Regular Expression Denial of Service (ReDoS) vulnerability in the Gotenberg package, specifically affecting versions up to and including 8.29.1.
The vulnerability occurs because Gotenberg uses the dlclark/regexp2 library to compile user-supplied scope patterns without setting a proper timeout, which means the regex compilation can run indefinitely.
Attackers can submit malicious regular expressions with nested quantifiers that cause excessive backtracking, hanging the Gotenberg worker indefinitely and leading to denial of service.
This issue affects the extraHttpHeaders form field at the /forms/chromium/screenshot/url endpoint, allowing remote attackers to exploit it without any privileges or user interaction.
How can this vulnerability impact me? :
This vulnerability can cause high availability disruption by allowing remote attackers to hang Gotenberg workers indefinitely.
As a result, the service becomes unavailable, potentially impacting any systems or users relying on Gotenberg for document format conversions.
The attack requires no privileges and no user interaction, making it easy to exploit remotely over the network.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring the behavior of Gotenberg workers, especially when they hang or become unresponsive after processing requests to the /forms/chromium/screenshot/url endpoint.
A practical detection method involves sending test requests with both benign and malicious regular expressions in the extraHttpHeaders field to observe response times and worker behavior.
For example, a proof-of-concept Python script can be used to send requests with a malicious regex pattern such as `([a-zA-Z0-9.:/_]+)+\!` to detect if the worker hangs indefinitely.
- Use curl or similar tools to send requests to the vulnerable endpoint with crafted regex patterns in the extraHttpHeaders field.
- Monitor CPU usage and response times of Gotenberg workers during these tests to identify excessive processing or hangs.
What immediate steps should I take to mitigate this vulnerability?
Since no patched versions are available at the time of reporting, immediate mitigation involves restricting access to the vulnerable endpoint and limiting user input that can be used to exploit the regex compilation.
Specifically, restrict or disable access to the /forms/chromium/screenshot/url endpoint for untrusted users to prevent submission of malicious regex patterns in the extraHttpHeaders field.
Additionally, monitor and restart Gotenberg workers that become unresponsive due to this vulnerability to restore service availability.
Consider implementing network-level protections such as rate limiting or firewall rules to block suspicious requests targeting this endpoint.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The provided information does not specify any direct impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.