CVE-2026-42594: Gotenberg race condition and process crash in webhook middleware

CVE-2026-42594 · Severity: high · CVSS 7.5 · Published 2026-05-14

Gotenberg is a specialized tool used to convert various file formats into PDFs via a web interface. A flaw in how the system handles background tasks (webhooks) allows an unauthenticated attacker to crash the entire service by sending a specific sequence of requests. This results in a denial-of-service, causing all active file conversions to fail and disrupting document processing workflows until the service is manually or automatically restarted.

Technologies: github.com/gotenberg/gotenberg/v7 (Go), github.com/gotenberg/gotenberg/v8 (Go), Gotenberg. Vendors: Go, Gotenberg.

Quick answers

Is CVE-2026-42594 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-42594 being exploited in the wild.
How severe is CVE-2026-42594?
High severity, with a CVSS score of 7.5, published 14 May 2026.
Which products and versions are affected?
github.com/gotenberg/gotenberg/v7 (Go) SEMVER:introduced=0; github.com/gotenberg/gotenberg/v8 (Go) <= 8.31.0, SEMVER:introduced=0,fixed=8.32.0; Gotenberg < 8.32.0, <= 8.31.0.
Is there a fix for CVE-2026-42594?
Yes. github.com/gotenberg/gotenberg/v8 (Go): upgrade to 8.32.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-42594 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-42594?
Check whether you run github.com/gotenberg/gotenberg/v7 (Go), github.com/gotenberg/gotenberg/v8 (Go) or Gotenberg at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • github.com/gotenberg/gotenberg/v8 (Go): upgrade to 8.32.0 or later
    go get github.com/gotenberg/gotenberg/v8@v8.32.0

Technical details

A race condition exists in the webhook middleware due to improper management of the Echo framework's context pool. When a webhook request is processed asynchronously, the middleware spawns a goroutine that retains a reference to the 'echo.Context' after the synchronous handler has already returned and recycled the context back into the 'sync.Pool'. If a concurrent request reclaims that context and resets it, the background goroutine may attempt an unchecked type assertion on a nil 'logger' entry within the 'hardTimeoutMiddleware'. Because this occurs outside of a recovery scope, it triggers a process-wide panic and crash. Attackers can reliably trigger this with a relatively low volume of concurrent webhook and status requests. The issue is resolved in version 8.32.0 by implementing guarded type assertions and better goroutine recovery.

Affected products

  • Gotenberg Gotenberg < 8.32.0

Identifiers

  • CVE-2026-42594
  • GHSA-r33j-c622-r6qp
  • GO-2026-5605

Timeline

  • 2026-04-30: advisory: GitHub Security Advisory published
  • 2026-05-14: disclosed: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.