Most recent entries from all

EUVD-2026-319105

2026-10-06T15:35:09.893815+00:00

EUVD-2026-319105

fkie_cve-2026-42594

2026-10-06T15:35:09.893866+00:00

Gotenberg is a Docker-powered stateless API for PDF files. Prior to 8.32.0, the webhook middleware spawns a goroutine that holds a reference to the request's echo.Context after the synchronous handler returns ErrAsyncProcess and Echo recycles the context back to its sync.Pool. When a concurrent request claims the recycled context, c.Reset() clears the store. If the webhook goroutine reaches hardTimeoutMiddleware at that moment, an unchecked type assertion on a nil store entry panics outside any recover() scope, crashing the Gotenberg process. Any anonymous caller reaches the webhook path (default webhook-deny-list filters only the webhook destination, not the submitter). A single-source stress of ~24 webhook requests plus ~60 GET /version requests crashes the process in about two seconds. This vulnerability is fixed in 8.32.0.

GHSA-r33j-c622-r6qp — Gotenberg has an unauthenticated denial of service via echo.Context pool reuse in webhook async goroutine

2026-10-06T15:35:09.893921+00:00

Affected: Go: github.com/gotenberg/gotenberg/v8

## Summary

The webhook middleware spawns a goroutine that holds a reference to the request's `echo.Context` after the synchronous handler returns `ErrAsyncProcess` and Echo recycles the context back to its `sync.Pool`. When a concurrent request claims the recycled context, `c.Reset()` clears the store. If the webhook goroutine reaches `hardTimeoutMiddleware` at that moment, an unchecked type assertion on a nil store entry panics outside any `recover()` scope, crashing the Gotenberg process. Any anonymous caller reaches the webhook path (default `webhook-deny-list` filters only the webhook destination, not the submitter). A single-source stress of ~24 webhook requests plus ~60 `GET /version` requests crashes the process in about two seconds.

## Details

`pkg/modules/webhook/middleware.go:338-382` starts the async goroutine and immediately returns `api.ErrAsyncProcess` to the caller:

```go w.asyncCount.Add(1) go func() { defer cancel() defer w.asyncCount.Add(-1)

err := next(c) // line 343 ... sendOutputFile(sendOutputFileParams{ ctx: ctx, ... }) }()

return api.ErrAsyncProcess // line 382 ```

`pkg/modules/api/middlewares.go:356-361` sees the sentinel, responds with `204 No Content`, and lets Echo return `c` to the pool:

```go if errors.Is(err, ErrAsyncProcess) { return c.NoContent(http.StatusNoContent) } ```

Echo's router calls `c.Reset()` before serving the next request from the same goroutine pool slot, wiping `c.…