https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 11:57:49 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-290198 EUVD-2026-290198 https://cve.radiocsirt.org/vuln/euvd-2026-290198 https://cve.radiocsirt.org/vuln/fkie_cve-2026-35458 <p>Gotenberg is an API for converting document formats. In 8.29.1 and earlier, Gotenberg uses dlclark/regexp2 to compile user-supplied scope patterns without setting a proper timeout. Users with access to features using this logic can hang workers indefinitely.</p> <p>Gotenberg is an API for converting document formats. In 8.29.1 and earlier, Gotenberg uses dlclark/regexp2 to compile user-supplied scope patterns without setting a proper timeout. Users with access to features using this logic can hang workers indefinitely.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-35458 https://cve.radiocsirt.org/vuln/ghsa-fmwg-qcqh-m992 <p><strong>Affected:</strong> Go: github.com/gotenberg/gotenberg/v8</p> <p>### Summary Gotenberg uses `dlclark/regexp2` to compile user-supplied scope patterns without setting a proper timeout. Users with access to features using this logic can hang workers indefinitely.</p> <p>### Details Gotenberg uses `dlclark/regexp2` to compile user-supplied scope patterns (gotenberg/pkg/modules/chromium/routes.go:200) with no MatchTimeout set, therefore using the default of math.MaxInt64 = &#34;forever&#34;.</p> <p>For example, any user with access to the endpoint `/forms/chromium/screenshot/url` can add a crafted scope pattern to the `extraHttpHeaders` form field using a nested quantifiers that causes infinite backtracking, hanging the Gotenberg worker indefinitely.</p> <p>See the [dlclark/regexp2 README.md](https://github.com/dlclark/regexp2?tab=readme-ov-file#catastrophic-backtracking-and-timeouts) for further considerations.</p> <p>Tested on the latest container version gotenberg/gotenberg:8.29.1</p> <p>### PoC</p> <p>The following Python script uses the `/forms/chromium/screenshot/url` endpoint, testing for differences in responses times between simple and malicious regexes.</p> <p>```python #!/usr/bin/env -S uv run --script # /// script # requires-python = &#34;&gt;=3.12&#34; # dependencies = [ # &#34;requests&#34;, # ] # /// import json import time import requests</p> <p>HOST = &#34;localhost:3000&#34; # HOST = &#34;gotenberg.local:3000&#34;</p> <p>def send_request(host: str, headers_dict: dict, label: str, timeout: int = 30): &#34;&#34;&#34;Send a screenshot request to Gotenberg and measure response time.&#34;&#34;&#34; url = f&#34;http://{host}/forms/chromium/s…</p> <p><strong>Affected:</strong> Go: github.com/gotenberg/gotenberg/v8</p> <p>### Summary Gotenberg uses `dlclark/regexp2` to compile user-supplied scope patterns without setting a proper timeout. Users with access to features using this logic can hang workers indefinitely.</p> <p>### Details Gotenberg uses `dlclark/regexp2` to compile user-supplied scope patterns (gotenberg/pkg/modules/chromium/routes.go:200) with no MatchTimeout set, therefore using the default of math.MaxInt64 = &#34;forever&#34;.</p> <p>For example, any user with access to the endpoint `/forms/chromium/screenshot/url` can add a crafted scope pattern to the `extraHttpHeaders` form field using a nested quantifiers that causes infinite backtracking, hanging the Gotenberg worker indefinitely.</p> <p>See the [dlclark/regexp2 README.md](https://github.com/dlclark/regexp2?tab=readme-ov-file#catastrophic-backtracking-and-timeouts) for further considerations.</p> <p>Tested on the latest container version gotenberg/gotenberg:8.29.1</p> <p>### PoC</p> <p>The following Python script uses the `/forms/chromium/screenshot/url` endpoint, testing for differences in responses times between simple and malicious regexes.</p> <p>```python #!/usr/bin/env -S uv run --script # /// script # requires-python = &#34;&gt;=3.12&#34; # dependencies = [ # &#34;requests&#34;, # ] # /// import json import time import requests</p> <p>HOST = &#34;localhost:3000&#34; # HOST = &#34;gotenberg.local:3000&#34;</p> <p>def send_request(host: str, headers_dict: dict, label: str, timeout: int = 30): &#34;&#34;&#34;Send a screenshot request to Gotenberg and measure response time.&#34;&#34;&#34; url = f&#34;http://{host}/forms/chromium/s…</p> https://cve.radiocsirt.org/vuln/ghsa-fmwg-qcqh-m992