CVE-2026-35458 Gotenberg has a ReDoS via extraHttpHeaders scope feature

What is CVE-2026-35458?

CVE-2026-35458 is a high-severity denial of service vulnerability in gotenberg, published on 7 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Gotenberg is an API for converting document formats. In 8.29.1 and earlier, Gotenberg uses dlclark/regexp2 to compile user-supplied scope patterns without setting a proper timeout. Users with access to features using this logic can hang workers indefinitely.

Weakness: CWE-1333

Which versions are affected by CVE-2026-35458?

4 open source packages ship an affected version, including github.com/gotenberg/gotenberg/v8 and github.com/gotenberg/gotenberg/v7. It affects 1 product.

Products include Thecodingmachine Gotenberg.

How do I fix CVE-2026-35458?

Upgrade github.com/gotenberg/gotenberg/v8 to 8.30.0 or later.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2026-35458 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-35458 exists.

Other vulnerabilities in gotenberg

• CVE-2026-40281 Gotenberg vulnerable to argument injection via newlines in ExifTool metadata values Critical 10.0
• CVE-2026-42589 Gotenberg: Unauthenticated RCE via ExifTool Metadata Key Injection Critical 9.8
• CVE-2020-13450 Path traversal in n/a Critical 9.8
• CVE-2020-13451 Code injection in n/a Critical 9.8
• CVE-2020-13452 Privilege escalation in n/a Critical 9.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-fmwg-qcqh-m992, GO-2026-5372.