CVE-2026-42594

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-42594", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-04-29T00:31:15.724Z", "datePublished": "2026-05-14T15:32:32.308Z", "dateUpdated": "2026-05-16T00:34:56.941Z"}, "containers": {"cna": {"title": "Gotenberg: Unauthenticated denial of service via echo.Context pool reuse in webhook async goroutine", "problemTypes": [{"descriptions": [{"cweId": "CWE-362", "lang": "en", "description": "CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/gotenberg/gotenberg/security/advisories/GHSA-r33j-c622-r6qp", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/gotenberg/gotenberg/security/advisories/GHSA-r33j-c622-r6qp"}], "affected": [{"vendor": "gotenberg", "product": "gotenberg", "versions": [{"version": "< 8.32.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-05-14T15:32:32.308Z"}, "descriptions": [{"lang": "en", "value": "Gotenberg is a Docker-powered stateless API for PDF files. Prior to 8.32.0, the webhook middleware spawns a goroutine that holds a reference to the request's echo.Context after the synchronous handler returns ErrAsyncProcess and Echo recycles the context back to its sync.Pool. When a concurrent request claims the recycled context, c.Reset() clears the store. If the webhook goroutine reaches hardTimeoutMiddleware at that moment, an unchecked type assertion on a nil store entry panics outside any recover() scope, crashing the Gotenberg process. Any anonymous caller reaches the webhook path (default webhook-deny-list filters only the webhook destination, not the submitter). A single-source stress of ~24 webhook requests plus ~60 GET /version requests crashes the process in about two seconds. This vulnerability is fixed in 8.32.0."}], "source": {"advisory": "GHSA-r33j-c622-r6qp", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/gotenberg/gotenberg/security/advisories/GHSA-r33j-c622-r6qp", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-05-16T00:33:54.440411Z", "id": "CVE-2026-42594", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-16T00:34:56.941Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-42594", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-16T00:33:54.440411Z"}}}], "references": [{"url": "https://github.com/gotenberg/gotenberg/security/advisories/GHSA-r33j-c622-r6qp", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-16T00:34:45.981Z"}}], "cna": {"title": "Gotenberg: Unauthenticated denial of service via echo.Context pool reuse in webhook async goroutine", "source": {"advisory": "GHSA-r33j-c622-r6qp", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "gotenberg", "product": "gotenberg", "versions": [{"status": "affected", "version": "< 8.32.0"}]}], "references": [{"url": "https://github.com/gotenberg/gotenberg/security/advisories/GHSA-r33j-c622-r6qp", "name": "https://github.com/gotenberg/gotenberg/security/advisories/GHSA-r33j-c622-r6qp", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "Gotenberg is a Docker-powered stateless API for PDF files. Prior to 8.32.0, the webhook middleware spawns a goroutine that holds a reference to the request's echo.Context after the synchronous handler returns ErrAsyncProcess and Echo recycles the context back to its sync.Pool. When a concurrent request claims the recycled context, c.Reset() clears the store. If the webhook goroutine reaches hardTimeoutMiddleware at that moment, an unchecked type assertion on a nil store entry panics outside any recover() scope, crashing the Gotenberg process. Any anonymous caller reaches the webhook path (default webhook-deny-list filters only the webhook destination, not the submitter). A single-source stress of ~24 webhook requests plus ~60 GET /version requests crashes the process in about two seconds. This vulnerability is fixed in 8.32.0."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-362", "description": "CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-05-14T15:32:32.308Z"}}}, "cveMetadata": {"cveId": "CVE-2026-42594", "state": "PUBLISHED", "dateUpdated": "2026-05-16T00:34:56.941Z", "dateReserved": "2026-04-29T00:31:15.724Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-05-14T15:32:32.308Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "gotenberg", "vendor": "gotenberg", "versions": [{"status": "affected", "version": "< 8.32.0"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:thecodingmachine:gotenberg:*:*:*:*:*:*:*:*", "matchCriteriaId": "F6763958-60E0-49F9-9B7B-35A1B94622D8", "versionEndExcluding": "8.32.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Gotenberg is a Docker-powered stateless API for PDF files. Prior to 8.32.0, the webhook middleware spawns a goroutine that holds a reference to the request's echo.Context after the synchronous handler returns ErrAsyncProcess and Echo recycles the context back to its sync.Pool. When a concurrent request claims the recycled context, c.Reset() clears the store. If the webhook goroutine reaches hardTimeoutMiddleware at that moment, an unchecked type assertion on a nil store entry panics outside any recover() scope, crashing the Gotenberg process. Any anonymous caller reaches the webhook path (default webhook-deny-list filters only the webhook destination, not the submitter). A single-source stress of ~24 webhook requests plus ~60 GET /version requests crashes the process in about two seconds. This vulnerability is fixed in 8.32.0."}, {"lang": "es", "value": "Gotenberg es una API sin estado impulsada por Docker para archivos PDF. Antes de la 8.32.0, el middleware de webhook genera una goroutine que mantiene una referencia al echo.Context de la solicitud despu\u00e9s de que el gestor s\u00edncrono devuelve ErrAsyncProcess y Echo recicla el contexto de vuelta a su sync.Pool. Cuando una solicitud concurrente reclama el contexto reciclado, c.Reset() borra el almac\u00e9n. Si la goroutine del webhook alcanza hardTimeoutMiddleware en ese momento, una aserci\u00f3n de tipo sin verificar en una entrada de almac\u00e9n nula provoca un p\u00e1nico fuera de cualquier \u00e1mbito de recover(), colapsando el proceso de Gotenberg. Cualquier llamador an\u00f3nimo alcanza la ruta del webhook (la lista de denegaci\u00f3n de webhook predeterminada filtra solo el destino del webhook, no el remitente). Un estr\u00e9s de una sola fuente de aproximadamente 24 solicitudes de webhook m\u00e1s aproximadamente 60 solicitudes GET /version colapsa el proceso en aproximadamente dos segundos. Esta vulnerabilidad se corrige en la versi\u00f3n 8.32.0."}], "id": "CVE-2026-42594", "lastModified": "2026-11-11T20:10:00.273", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-42594", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-05-16T00:33:54.440411Z", "version": "2.0.3"}}]}, "published": "2026-05-14T16:16:22.613", "references": [{"source": "security-advisories@github.com", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "url": "https://github.com/gotenberg/gotenberg/security/advisories/GHSA-r33j-c622-r6qp"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "url": "https://github.com/gotenberg/gotenberg/security/advisories/GHSA-r33j-c622-r6qp"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-362"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,8.32.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "gotenberg", "source": "cna", "vendor": "gotenberg"}, "product": "gotenberg", "vendor": "gotenberg"}], "created": "2026-05-14T17:30:15.696460+00:00", "updated": "2026-05-14T19:00:13.403455+00:00", "vendors": ["gotenberg", "gotenberg$PRODUCT$gotenberg"]}