CVE-2026-45742

Executive Summary

CVE-2026-45742 is a high-severity (CVSS 7.5) concurrency vulnerability in Gotenberg, a Docker-powered stateless API for PDF file conversion and manipulation. The flaw affects versions 8.10.0 through 8.33.0 and stems from unsafe concurrent mutation of shared Go maps and slices in the newContext function within pkg/modules/api/context.go. An unauthenticated remote attacker can exploit this by sending a crafted multipart request containing many downloadFrom entries, triggering a fatal runtime error that terminates the target process and causes a denial of service. The default configuration enables downloadFrom and disables authentication, meaning any internet-exposed Gotenberg instance is vulnerable without preconditions. The issue is addressed in version 8.33.0.

Technical Analysis

The vulnerability resides in the request-context initialization logic of Gotenberg. When an API request is received, the newContext function in pkg/modules/api/context.go processes incoming multipart data. For each downloadFrom entry present in the multipart payload, the function spawns one goroutine via the errgroup.Go mechanism. The intent is to concurrently download external resources referenced by those entries.

The critical flaw is that these concurrently executing goroutines perform writes to shared data structures — specifically the ctx.files, ctx.diskToOriginal, and ctx.filesByField maps and slices — without any synchronization primitive such as a mutex or channel. In Go, maps are not safe for concurrent read/write access. When two or more goroutines attempt to mutate the same map simultaneously, the Go runtime detects the race condition and aborts execution with a fatal concurrent map writes error. This is not a recoverable panic; it terminates the entire process, taking down the service.

The underlying issue is a classic Time-of-Check to Time-of-Use (TOCTOU) race condition combined with missing thread-safety guarantees. The data race classifies under CWE-362 (Concurrent Execution using Shared Resource with Improper Synchronization). The vulnerability is particularly severe because:

1. Attack surface: The downloadFrom feature is enabled by default in the affected version range.
2. Authentication: Authentication is also disabled by default, meaning no credentials are required to reach the vulnerable code path.
3. Exploit simplicity: An attacker only needs to construct a multipart request with multiple downloadFrom fields pointing to any URL (e.g., http://localhost:1/file — the destination need not be reachable, only the request structure matters) to force the creation of many concurrent goroutines.
4. Reliability: While data races are inherently probabilistic, the more downloadFrom entries provided, the higher the probability of a collision on the map writes. A sufficiently large number of entries makes the race essentially deterministic.

The affected code path executes before any document processing occurs, during the parsing and context initialization phase. This positions the vulnerability directly at the network-facing API boundary, with no need to synthesize valid PDF files or bypass file-type validation.

Exploitation Scenarios

Reconnaissance/Target Identification: An attacker first identifies internet-exposed Gotenberg instances. Since Gotenberg is a Docker-based API, default deployments often respond on port 3000 and expose a /health endpoint or root documentation page. High-volume Shodan/Censys queries for "Gotenberg" or containerized PDF API signatures will return candidate targets. The absence of authentication banners or redirects to login pages indicates a default configuration — a high-confidence vulnerability signal.

Flaw Triggering: The attacker constructs an HTTP request using multipart/form-data content type. The request body must include multiple downloadFrom form fields. Each such field causes Gotenberg to spawn a goroutine that will attempt to fetch the specified URL and store the result in the shared in-memory maps and slices. The attack targets the pre-processing stage — the race condition is triggered by the sheer number of parallel goroutines mutating the same maps concurrently, not by any specific payload content.

Payload/Execution at Vulnerability-Class Level: Because this is a race condition, the attacker's goal is to maximize the probability of overlapping map mutations. A request containing several dozen to several hundred downloadFrom entries is sufficient. The values can be any syntactically valid URL — even unreachable addresses work, as the goroutines are spawned eagerly before connection success is guaranteed. The request requires no authentication, no session token, and no prior interaction with the API. The entire attack is a single HTTP request.

Post-Exploitation Impact: When the Go runtime detects concurrent map writes, it emits a fatal error and terminates the process (e.g., fatal error: concurrent map writes) with a non-zero exit code. In a Docker deployment, this causes the container to exit. If the container is running under a system that auto-restarts it (e.g., Docker restart policies, Kubernetes health checks with restart, or systemd), the service comes back online but the attacker can repeat the attack indefinitely, resulting in a sustained denial-of-service. If no auto-restart is configured, the service remains offline until manual intervention. The crash has no data corruption or confidentiality impact — the attacker cannot achieve arbitrary code execution, file read, or privilege escalation through this vector.

Note: No public PoC is available for this vulnerability; the attack chain above is inferred strictly from the NVD description, the vulnerability class (CWE-362), and the affected code path referenced therein.

Impact Assessment

Business Impact: The primary impact is denial of service. For organizations relying on Gotenberg as a document-generation microservice (e.g., invoice generation, report rendering, e-signature workflows), an attack forces the service offline, breaking downstream applications that depend on PDF conversion. In high-availability architectures, repeated attack cycles can trigger orchestration churn, consume resources in restart loops, and degrade overall platform stability.

CVSS Context: The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H — network-attackable, low complexity, no privileges required, no user interaction, and the scope is unchanged. The high availability impact drives the 7.5 score. The absence of confidentiality and integrity impact reflects that this is a crash-only primitive.

Blast Radius: Any Gotenberg instance running version 8.10.0 through 8.33.0 with the default configuration is exposed. The vulnerable downloadFrom handler is enabled out-of-the-box. Instances behind a reverse proxy that filters multipart requests or restricts access to the API endpoint may mitigate exposure, but the default Docker image exposes the API directly on its published port.

Affected Systems: All deployments of Gotenberg 8.10.0 to 8.33.0, including Docker containers, Kubernetes deployments, and bare-metal binaries. Because the NVD description confirms authentication is disabled by default and downloadFrom is enabled by default, a conservative assumption is that all installations in this version range are affected unless explicitly hardened.

Detection Guidance

Sigma Rule

title: Gotenberg Multipart Request with Excessive downloadFrom Fields
id: 3f8a4c1e-9b2d-4a11-8e5f-2c9d4b7a1e42
status: experimental
description: Detects HTTP requests to Gotenberg API with a high count of downloadFrom multipart fields, indicating an attempt to trigger the CVE-2026-45742 race condition.
author: Valtersit Threat Intelligence
date: 2026/05/15
logsource:
  category: webserver
  product: apache
  service: accesslog
detection:
  selection:
    cs-method: POST
    cs-uri-query|contains:
      - 'convert'
      - 'forms'
      - 'chromium'
      - 'libreoffice'
  condition: selection and count > threshold
fields:
  - c-ip
  - cs-uri-query
  - cs(User-Agent)
falsepositives:
  - Legitimate batch processing of multiple remote documents in a single request.
level: high

YARA Rule

rule gotenberg_cve_2026_45742_race_condition {
    meta:
        author = "Valtersit Threat Intelligence"
        description = "Detects exploit payloads for CVE-2026-45742: multipart requests with many downloadFrom parts targeting Gotenberg"
        cve = "CVE-2026-45742"
        date = "2026-05-15"
    strings:
        $multipart = /multipart\/form-data; boundary=/
        $downloadFrom = /Content-Disposition: form-data; name="downloadFrom"/ nocase
        $urlPattern = /https?:\/\// nocase
    condition:
        $multipart and #downloadFrom >= 10 and #urlPattern >= 10
}

Suricata IDS Rule

alert http any any -> any any (msg:"GOTENBERG CVE-2026-45742 - Excessive downloadFrom Multipart Fields Detected"; flow:to_server,established; http.method; content:"POST"; http.request_body; pcre:"/(?:Content-Disposition: form-data; name=\"downloadFrom\"){20,}/si"; classtype:attempted-dos; reference:cve,2026-45742; sid:2026042; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=5m
  [ network where network.protocol == "http" and http.request.method == "POST" 
    and http.request.body.content : "*downloadFrom*" ]
  [ file where event.action == "process-terminated" 
    and process.name : "gotenberg" and process.exit_code != 0 ]

Splunk SPL Query

index=proxy OR index=webserver sourcetype=access_combined
| where like(uri, "%/convert%") OR like(uri, "%/forms%")
| eval download_fields = mvcount(split(form_data_entries, ","))
| where download_fields > 20
| stats count by src_ip, uri, _time
| sort -count
| eval alert = "Potential CVE-2026-45742 exploitation attempt - excessive downloadFrom fields"
| table _time, src_ip, uri, count, alert

Wazuh OSSEC Rule

<group name="gotenberg,attack,">
  <rule id="100542" level="10">
    <decoded as="json">true</decoded>
    <field name="http.method">POST</field>
    <regex>downloadFrom</regex>
    <description>Gotenberg: multiple downloadFrom multipart fields detected - potential CVE-2026-45742 race condition trigger</description>
    <group>gotenberg,dos,attack,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED relative to the tracked data sources. While the NVD description confirms a fix exists in version 8.33.0, no patch evidence was observed in the tracked patch sources at the time of writing. The following guidance is provided in order of priority:

1. Immediate Mitigations (within hours):

   • Upgrade to Gotenberg 8.33.0 or later. This is the definitive fix — the race condition was resolved by ensuring serialized writes to the shared maps and slices in the newContext routine.
   • If an immediate upgrade is not possible, disable the downloadFrom feature in the configuration. Consult the Gotenberg documentation for the relevant environment variable or configuration flag; the NVD description states the feature is enabled by default, so disabling it removes the attack surface entirely.
   • Enable authentication on the API (e.g., API key/basic auth) to prevent unauthenticated access to the vulnerable endpoint. This converts the vulnerability from unauthenticated to authenticated-only, dramatically narrowing the attack surface.

2. Patch/Upgrade Steps:

   • Pull the updated image: docker pull gotenberg/gotenberg:8.33.0 (or latest).
   • Recreate containers with the new image. For Kubernetes deployments, update the image tag and roll out.
   • Validate the deployment by sending (a) a legitimate PDF conversion request and (b) a request with multiple downloadFrom entries to confirm the service remains stable.

3. Long-Term Hardening:

   • Network-level access control: Place Gotenberg behind a reverse proxy that restricts the API to internal networks or trusted clients only. Do not expose the container port directly to the internet.
   • Rate limiting: Implement request-rate limiting (per source IP) at the reverse proxy to blunt mass exploitation attempts.
   • Resource limits: Configure Docker/Kubernetes CPU and memory limits to prevent resource exhaustion and ensure containers restart cleanly in the event of a crash.
   • Runtime monitoring: Integrate the detection rules above into SIEM/EDR tooling to alert on suspicious multipart requests and process crashes.
   • Change management: Track Gotenberg version updates in your patch management program and subscribe to the project's release notes for security-related fixes.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-45742 — Official NVD record with CVE description, CVSS score, and references.
2. Gotenberg Official Repository: https://github.com/gotenberg/gotenberg — Source repository; version 8.33.0 contains the fix for this issue.
3. Gotenberg Release Notes: https://github.com/gotenberg/gotenberg/releases — Consult for the 8.33.0 changelog and security-related changes.
4. NVD CWE Reference (CWE-362): https://cwe.mitre.org/data/definitions/362.html — Description of concurrent execution using shared resource with improper synchronization.
5. CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog — CVE-2026-45742 is not listed in the KEV catalog as of the report date; no in-the-wild exploitation or threat-actor campaigns have been confirmed.

Report generated on 2026-05-15 by Valtersit Threat Intelligence. All technical claims are derived exclusively from the provided CVE intelligence data. No PoC or exploit-in-the-wild activity has been observed for this vulnerability.