CVE-2026-45742

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-45742", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-05-13T06:54:34.220Z", "datePublished": "2026-08-19T14:34:15.080Z", "dateUpdated": "2026-08-19T15:29:39.998Z"}, "containers": {"cna": {"title": "Gotenberg: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')", "problemTypes": [{"descriptions": [{"cweId": "CWE-362", "lang": "en", "description": "CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/gotenberg/gotenberg/security/advisories/GHSA-vp73-vjw8-8f32", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/gotenberg/gotenberg/security/advisories/GHSA-vp73-vjw8-8f32"}, {"name": "https://github.com/gotenberg/gotenberg/commit/6671b5e5d30289087ca80130fc76f130cfa4dd7b", "tags": ["x_refsource_MISC"], "url": "https://github.com/gotenberg/gotenberg/commit/6671b5e5d30289087ca80130fc76f130cfa4dd7b"}, {"name": "https://github.com/gotenberg/gotenberg/releases/tag/v8.33.0", "tags": ["x_refsource_MISC"], "url": "https://github.com/gotenberg/gotenberg/releases/tag/v8.33.0"}], "affected": [{"vendor": "gotenberg", "product": "gotenberg", "versions": [{"version": ">= 8.10.0, < 8.33.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-19T14:34:15.080Z"}, "descriptions": [{"lang": "en", "value": "Gotenberg is a Docker-powered stateless API for PDF files. From 8.10.0 until 8.33.0, the newContext function in pkg/modules/api/context.go starts one errgroup.Go goroutine for each multipart downloadFrom entry and allows those goroutines to concurrently write to the shared ctx.files, ctx.diskToOriginal, and ctx.filesByField maps and slices. Go maps and slices are not safe for concurrent mutation, so a crafted multipart request containing many downloadFrom entries can trigger a data race and terminate the process with a fatal concurrent map writes runtime error. The default configuration enables downloadFrom and disables authentication, allowing an unauthenticated remote attacker to crash an exposed conversion service and cause a denial of service. This issue is fixed in version 8.33.0."}], "source": {"advisory": "GHSA-vp73-vjw8-8f32", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/gotenberg/gotenberg/security/advisories/GHSA-vp73-vjw8-8f32", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-19T15:29:09.140356Z", "id": "CVE-2026-45742", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-19T15:29:39.998Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-45742", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-19T15:29:09.140356Z"}}}], "references": [{"url": "https://github.com/gotenberg/gotenberg/security/advisories/GHSA-vp73-vjw8-8f32", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-19T15:29:33.178Z"}}], "cna": {"title": "Gotenberg: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')", "source": {"advisory": "GHSA-vp73-vjw8-8f32", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "gotenberg", "product": "gotenberg", "versions": [{"status": "affected", "version": ">= 8.10.0, < 8.33.0"}]}], "references": [{"url": "https://github.com/gotenberg/gotenberg/security/advisories/GHSA-vp73-vjw8-8f32", "name": "https://github.com/gotenberg/gotenberg/security/advisories/GHSA-vp73-vjw8-8f32", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/gotenberg/gotenberg/commit/6671b5e5d30289087ca80130fc76f130cfa4dd7b", "name": "https://github.com/gotenberg/gotenberg/commit/6671b5e5d30289087ca80130fc76f130cfa4dd7b", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/gotenberg/gotenberg/releases/tag/v8.33.0", "name": "https://github.com/gotenberg/gotenberg/releases/tag/v8.33.0", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Gotenberg is a Docker-powered stateless API for PDF files. From 8.10.0 until 8.33.0, the newContext function in pkg/modules/api/context.go starts one errgroup.Go goroutine for each multipart downloadFrom entry and allows those goroutines to concurrently write to the shared ctx.files, ctx.diskToOriginal, and ctx.filesByField maps and slices. Go maps and slices are not safe for concurrent mutation, so a crafted multipart request containing many downloadFrom entries can trigger a data race and terminate the process with a fatal concurrent map writes runtime error. The default configuration enables downloadFrom and disables authentication, allowing an unauthenticated remote attacker to crash an exposed conversion service and cause a denial of service. This issue is fixed in version 8.33.0."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-362", "description": "CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-19T14:34:15.080Z"}}}, "cveMetadata": {"cveId": "CVE-2026-45742", "state": "PUBLISHED", "dateUpdated": "2026-08-19T15:29:39.998Z", "dateReserved": "2026-05-13T06:54:34.220Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-08-19T14:34:15.080Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "gotenberg", "vendor": "gotenberg", "versions": [{"status": "affected", "version": ">= 8.10.0, < 8.33.0"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Gotenberg is a Docker-powered stateless API for PDF files. From 8.10.0 until 8.33.0, the newContext function in pkg/modules/api/context.go starts one errgroup.Go goroutine for each multipart downloadFrom entry and allows those goroutines to concurrently write to the shared ctx.files, ctx.diskToOriginal, and ctx.filesByField maps and slices. Go maps and slices are not safe for concurrent mutation, so a crafted multipart request containing many downloadFrom entries can trigger a data race and terminate the process with a fatal concurrent map writes runtime error. The default configuration enables downloadFrom and disables authentication, allowing an unauthenticated remote attacker to crash an exposed conversion service and cause a denial of service. This issue is fixed in version 8.33.0."}, {"lang": "es", "value": "Gotenberg es una API sin estado impulsada por Docker para archivos PDF. Desde la 8.10.0 hasta la 8.33.0, la funci\u00f3n newContext en pkg/modules/api/context.go inicia una goroutine errgroup.Go por cada entrada multipart downloadFrom y permite que esas goroutines escriban concurrentemente en los mapas y slices compartidos ctx.files, ctx.diskToOriginal y ctx.filesByField. Los mapas y slices de Go no son seguros para la mutaci\u00f3n concurrente, por lo que una solicitud multipart elaborada que contenga muchas entradas downloadFrom puede desencadenar una condici\u00f3n de carrera y terminar el proceso con un error de tiempo de ejecuci\u00f3n fatal de escrituras concurrentes en mapas. La configuraci\u00f3n predeterminada habilita downloadFrom y deshabilita la autenticaci\u00f3n, permitiendo a un atacante remoto no autenticado bloquear un servicio de conversi\u00f3n expuesto y causar una denegaci\u00f3n de servicio. Este problema est\u00e1 solucionado en la versi\u00f3n 8.33.0."}], "id": "CVE-2026-45742", "lastModified": "2026-10-27T13:10:00.360", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-45742", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-08-19T15:29:09.140356Z", "version": "2.0.3"}}]}, "published": "2026-08-19T15:17:05.170", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/gotenberg/gotenberg/commit/6671b5e5d30289087ca80130fc76f130cfa4dd7b"}, {"source": "security-advisories@github.com", "url": "https://github.com/gotenberg/gotenberg/releases/tag/v8.33.0"}, {"source": "security-advisories@github.com", "url": "https://github.com/gotenberg/gotenberg/security/advisories/GHSA-vp73-vjw8-8f32"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/gotenberg/gotenberg/security/advisories/GHSA-vp73-vjw8-8f32"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-362"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[8.10.0,8.33.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "gotenberg", "source": "cna", "vendor": "gotenberg"}, "product": "gotenberg", "vendor": "gotenberg"}], "created": "2026-08-19T16:00:04.406211+00:00", "updated": "2026-08-20T15:45:03.422656+00:00", "vendors": ["gotenberg", "gotenberg$PRODUCT$gotenberg"]}