Gotenberg up to 8.32.x context.go newContext race condition

Summaryinfo

A vulnerability was found in Gotenberg up to 8.32.x. It has been declared as critical. This affects the function newContext of the file pkg/modules/api/context.go. Such manipulation leads to race condition. This vulnerability is listed as CVE-2026-45742. The attack may be performed from remote. There is no available exploit.

Detailsinfo

A vulnerability was found in Gotenberg up to 8.32.x and classified as critical. Affected by this issue is the function newContext of the file pkg/modules/api/context.go. The manipulation with an unknown input leads to a race condition vulnerability. Using CWE to declare the problem leads to CWE-362. The product contains a code sequence that can run concurrently with other code, and the code sequence requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence that is operating concurrently. Impacted is availability. CVE summarizes:

Gotenberg is a Docker-powered stateless API for PDF files. From 8.10.0 until 8.33.0, the newContext function in pkg/modules/api/context.go starts one errgroup.Go goroutine for each multipart downloadFrom entry and allows those goroutines to concurrently write to the shared ctx.files, ctx.diskToOriginal, and ctx.filesByField maps and slices. Go maps and slices are not safe for concurrent mutation, so a crafted multipart request containing many downloadFrom entries can trigger a data race and terminate the process with a fatal concurrent map writes runtime error. The default configuration enables downloadFrom and disables authentication, allowing an unauthenticated remote attacker to crash an exposed conversion service and cause a denial of service. This issue is fixed in version 8.33.0.

The advisory is available at github.com. This vulnerability is handled as CVE-2026-45742 since 05/13/2026. The exploitation is known to be easy. The attack may be launched remotely. No form of authentication is required for exploitation. Technical details are known, but there is no available exploit.

Upgrading to version 8.33.0 eliminates this vulnerability.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Name

• Gotenberg

Version

• 8.0
• 8.1
• 8.2
• 8.3
• 8.4
• 8.5
• 8.6
• 8.7
• 8.8
• 8.9
• 8.10
• 8.11
• 8.12
• 8.13
• 8.14
• 8.15
• 8.16
• 8.17
• 8.18
• 8.19
• 8.20
• 8.21
• 8.22
• 8.23
• 8.24
• 8.25
• 8.26
• 8.27
• 8.28
• 8.29
• 8.30
• 8.31
• 8.32

Website

• Product: https://github.com/gotenberg/gotenberg/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion