Race condition in gotenberg - CVE-2026-45742
Published: November 9, 2026
Vulnerability identifier: #VU162916
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-45742
CWE-ID: CWE-362
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an unauthenticated remote attacker to terminate the Gotenberg process and deny service to users.
The vulnerability exists due to unsynchronized writes to shared maps during multipart downloadFrom processing when a request contains multiple download entries. An unauthenticated remote attacker can submit a crafted request to an exposed multipart conversion endpoint with downloadFrom enabled and authentication disabled, as in the default configuration, to trigger a process crash.
Affected software
gotenberg
How to mitigate CVE-2026-45742
Install security update from vendor's website.
gotenberg - update to 8.33.0