CVE-2026-45742 gotenberg CVE debrief

Who should care

Defenders responsible for Gotenberg conversion services, especially those with unauthenticated access enabled, should assess exposure and potential impact. They should verify if Gotenberg conversion services are exposed and unauthenticated, assess the potential impact of a denial-of-service attack on operations, and update to version 8.33.0 or later if vulnerable. Additionally, defenders should review compensating controls for exposed systems while

Why it matters

CVE-2026-45742 is a denial-of-service vulnerability in Gotenberg that allows an unauthenticated remote attacker to crash an exposed conversion service. Defenders should verify exposure, assess impact, and update to version 8.33.0 or later if vulnerable.

• Denial-of-service attack can crash exposed conversion services
• Unauthenticated access allows remote exploitation
• Fixed version 8.33.0 or later is available
• Verification of exposure and impact is necessary

Technical summary

The newContext function in pkg/modules/api/context.go starts multiple goroutines for each multipart downloadFrom entry, allowing concurrent writes to shared maps and slices. A crafted multipart request can trigger a data race, terminating the process with a fatal concurrent map writes runtime error. This issue is fixed in version 8.33.0. The vulnerability allows an unauthenticated remote attacker to crash an exposed conversion service, causing a denial-of-service attack. Defenders should prioritize verifying exposure of Gotenberg conversion services, especially if unauthenticated access is enabled, and assess the potential impact of a denial-of-service attack on their operations.

Defensive priority

Defenders should prioritize verifying exposure of Gotenberg conversion services, especially if unauthenticated access is enabled, and assess the potential impact of a denial-of-service attack on their operations.

Recommended defensive actions

• Verify if Gotenberg conversion services are exposed and unauthenticated
• Assess the potential impact of a denial-of-service attack on operations
• Update to version 8.33.0 or later if vulnerable
• Monitor for potential exploitation attempts
• Review compensating controls for exposed systems
• Track exceptions and retest remediated assets
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details about the vulnerability, its impact, and the fixed version. However, additional information about potential exploitation or affected systems is limited. Defenders should verify exposure of Gotenberg conversion services, especially if unauthenticated access is enabled, and assess the potential impact of a denial-of-service attack on their operations. The lack of authentication allows for remote exploitation, and defenders should review compensating controls for exposed systems while

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.