CVE-2026-45742

Name of the Vulnerable Software and Affected Versions Gotenberg versions 8.10.0 through 8.x

Description Gotenberg is susceptible to a remote denial of service due to a race condition when handling multipart requests. When a request contains multiple downloadFrom entries, the system initiates concurrent goroutines that write to shared maps without proper synchronization. This lack of synchronization can lead to a runtime crash with a fatal error regarding concurrent map writes. In default configurations where downloadFrom is enabled and authentication is disabled, an unauthenticated remote attacker can crash the process. The issue occurs within the newContext() function in pkg/modules/api/context.go during the processing of the downloadFrom form field.

Recommendations As a temporary mitigation, restrict access to the downloadFrom feature or enable authentication to prevent unauthenticated remote attackers from triggering the crash. At the moment, there is no information about a newer version that contains a fix for this vulnerability.