CVE-2026-42592: Gotenberg: DNS rebinding bypasses SSRF validation on Chromium URL conversion routes

Vulnerability summary

CVE-2026-42592 is a medium (CVSS 5.3) vulnerability in gotenberg. EPSS estimates a 0.19% chance of exploitation in the next 30 days, higher than 8.9% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 14-05-2026
   PublishedVulnerability first disclosed.
2. 14-05-2026
   Last modifiedVulnerability information updated.

Description

Gotenberg is a Docker-powered stateless API for PDF files. Prior to 8.32.0, FilterOutboundURL resolves the hostname, checks the resolved IPs against the private-address deny-list, and returns only the error. It discards the resolved addresses. Chromium later performs its own DNS resolution when it navigates to the URL. An attacker who controls DNS for a hostname with a short TTL returns a public IP on the first query (Gotenberg allows) and a private IP on the second query (Chromium connects to the attacker-chosen internal address). The CDP Fetch.requestPaused handler re-checks the URL but runs its own DNS resolution, leaving a timing window before Chromium's actual TCP connect. The rendered internal service response returns to the caller as a PDF. This vulnerability is fixed in 8.32.0.

• CWE-367Time-of-check Time-of-use (TOCTOU) Race ConditionThe product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check.
• CWE-918Server-Side Request ForgeryThe web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.