Description

Gotenberg is a Docker-powered stateless API for PDF files. From 8.10.0 until 8.33.0, the newContext function in pkg/modules/api/context.go starts one errgroup.Go goroutine for each multipart downloadFrom entry and allows those goroutines to concurrently write to the shared ctx.files, ctx.diskToOriginal, and ctx.filesByField maps and slices. Go maps and slices are not safe for concurrent mutation, so a crafted multipart request containing many downloadFrom entries can trigger a data race and terminate the process with a fatal concurrent map writes runtime error. The default configuration enables downloadFrom and disables authentication, allowing an unauthenticated remote attacker to crash an exposed conversion service and cause a denial of service. This issue is fixed in version 8.33.0.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-19T15:17:05.170Z",
  "pubdate": "2026-08-19T15:17:05.170Z",
  "executiveSummary": "Gotenberg versions 8.10.0 through 8.33.0 suffer from a concurrency-related vulnerability involving unsafe parallel mutations to shared data structures.\nThe vulnerability manifests as a data race when processing crafted multipart requests, leading to a fatal concurrent map writes runtime error that terminates the application process.\nThis introduces a denial of service risk against exposed conversion services.\nAn unauthenticated remote attacker can exploit this flaw by leveraging default configurations where authentication is disabled and the downloadFrom feature is active.\nThe attack requires no special privileges or prior access, allowing malicious actors to repeatedly crash the service via network requests.",
  "technicalDetails": "The vulnerability resides in the newContext function located within the pkg/modules/api/context.go file of Gotenberg.\nThe affected versions are from 8.10.0 up to, but not including, 8.33.0.\nThe root cause stems from improper synchronization when handling asynchronous tasks spawned via errgroup.Go goroutines.\nSpecifically, the application initiates a separate goroutine for each multipart downloadFrom entry provided in an incoming request.\nThese concurrently executing goroutines attempt to write to shared maps and slices, namely ctx.files, ctx.diskToOriginal, and ctx.filesByField, without employing proper synchronization primitives such as mutexes.\nIn the Go programming language, built-in maps and slices are explicitly not safe for concurrent mutation by multiple goroutines.\nWhen multiple goroutines write to these shared memory locations simultaneously, the Go runtime detects a data race condition.\nThis triggers a fatal concurrent map writes runtime error, immediately terminating the entire Gotenberg process and resulting in a denial of service.\nThe attack flow begins when an unauthenticated remote attacker sends a maliciously crafted multipart HTTP request containing a large volume of downloadFrom entries.\nBecause the default configuration of Gotenberg enables the downloadFrom feature and leaves authentication disabled, the vulnerable endpoint is openly accessible over the network without requiring any credentials or privileges.\nUpon receiving the payload, the application spawns multiple concurrent goroutines that race to populate the shared context maps and slices.\nThe resulting memory corruption condition forces a panic and process termination.\nRepeated sending of this payload enables the attacker to maintain a sustained denial of service state, preventing legitimate users from accessing PDF conversion functionalities."
}