8.7

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-35458

CVE-2026-35458: Gotenberg has a ReDoS via extraHttpHeaders scope feature

Gotenberg is an API for converting document formats. In 8.29.1 and earlier, Gotenberg uses dlclark/regexp2 to compile user-supplied scope patterns without setting a proper timeout. Users with access to features using this logic can hang workers indefinitely.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-35458

CVE-2026-35458:

8.7

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/gotenberg/gotenberg/v8	go	<= 8.29.1	8.30.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The analysis of the provided security advisory and the associated commit cfb48d9af48cb236244eabe5c67fe1d30fb3fe25 clearly points to a Regular Expression Denial of Service (ReDoS) vulnerability. The vulnerability exists because user-supplied regular expression patterns in the extraHttpHeaders field were compiled and executed without a timeout, allowing a crafted pattern to cause catastrophic backtracking and hang the service. The patch was applied to the FormDataChromiumOptions function in pkg/modules/chromium/routes.go, which is responsible for parsing these headers. The fix involves setting a MatchTimeout on the compiled regular expression object. Therefore, FormDataChromiumOptions is the vulnerable function as it's the entry point for processing the malicious input.

Vulnerable functions

FormDataChromiumOptions

pkg/modules/chromium/routes.go

The vulnerability lies in the `FormDataChromiumOptions` function, which processes user-supplied `extraHttpHeaders`. Within this function, a regular expression is compiled from the headers without a timeout. An attacker can provide a malicious regex pattern (a.k.a. 'evil regex') that causes the `regexp2.Compile` to hang, leading to a denial of service. The patch mitigates this by adding a 5-second timeout to the regex matching operation.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.