Compliance Impact

The provided information does not specify any direct impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0

Executive Summary

CVE-2026-35458 is a Regular Expression Denial of Service (ReDoS) vulnerability in the Gotenberg package, specifically affecting versions up to and including 8.29.1.

The vulnerability occurs because Gotenberg uses the dlclark/regexp2 library to compile user-supplied scope patterns without setting a proper timeout, which means the regex compilation can run indefinitely.

Attackers can submit malicious regular expressions with nested quantifiers that cause excessive backtracking, hanging the Gotenberg worker indefinitely and leading to denial of service.

This issue affects the extraHttpHeaders form field at the /forms/chromium/screenshot/url endpoint, allowing remote attackers to exploit it without any privileges or user interaction.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can cause high availability disruption by allowing remote attackers to hang Gotenberg workers indefinitely.

As a result, the service becomes unavailable, potentially impacting any systems or users relying on Gotenberg for document format conversions.

The attack requires no privileges and no user interaction, making it easy to exploit remotely over the network.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by monitoring the behavior of Gotenberg workers, especially when they hang or become unresponsive after processing requests to the /forms/chromium/screenshot/url endpoint.

A practical detection method involves sending test requests with both benign and malicious regular expressions in the extraHttpHeaders field to observe response times and worker behavior.

For example, a proof-of-concept Python script can be used to send requests with a malicious regex pattern such as `([a-zA-Z0-9.:/_]+)+\!` to detect if the worker hangs indefinitely.

• Use curl or similar tools to send requests to the vulnerable endpoint with crafted regex patterns in the extraHttpHeaders field.
• Monitor CPU usage and response times of Gotenberg workers during these tests to identify excessive processing or hangs.

Useful 0 Not Useful 0

Mitigation Strategies

Since no patched versions are available at the time of reporting, immediate mitigation involves restricting access to the vulnerable endpoint and limiting user input that can be used to exploit the regex compilation.

Specifically, restrict or disable access to the /forms/chromium/screenshot/url endpoint for untrusted users to prevent submission of malicious regex patterns in the extraHttpHeaders field.

Additionally, monitor and restart Gotenberg workers that become unresponsive due to this vulnerability to restore service availability.

Consider implementing network-level protections such as rate limiting or firewall rules to block suspicious requests targeting this endpoint.

Useful 0 Not Useful 0