Executive brief
Gotenberg Vulnerable to ReDoS via extraHttpHeaders scope feature in github.com/gotenberg/gotenberg
Affected products
- Go github.com/gotenberg/gotenberg/v8
- Go github.com/gotenberg/gotenberg/v7
Junglewise Threat Intelligence
CVE-2026-35458: GO-2026-5372 - Gotenberg Vulnerable to ReDoS via extraHttpHeaders scope feature in github.com/gotenberg/gotenberg
CVE-2026-35458 · Severity: medium · CVSS 4 · Published 2026-06-25
Technologies: github.com/gotenberg/gotenberg/v8 (Go). Vendors: Go.
Related threats
- Gotenberg SSRF and local file disclosure in LibreOffice conversion
- GO-2026-5587 - Gotenberg has incomplete fix for ExifTool arbitrary file write: case-insensitive bypass and missing HardLink/SymLink tags in github.com/gote
- Gotenberg race condition in multipart downloadFrom handling
- Gotenberg SSRF deny-list bypass in IsPublicIP via IPv6 prefixes
- Gotenberg path traversal via Windows-style separators in ZIP entry names