Most recent entries from all

EUVD-2026-356506

fkie_cve-2026-45741

Gotenberg is a Docker-powered stateless API for PDF files. In 8.32.0 and earlier, the IsPublicIP function in pkg/gotenberg/outbound.go does not reject the 2002::/16 6to4 prefix, the 64:ff9b::/96 and 64:ff9b:1::/48 NAT64 prefixes, the fec0::/10 deprecated site-local prefix, Teredo, and other transition prefixes that can embed or route to non-public IPv4 destinations. The addr.Unmap operation only handles IPv4-mapped IPv6 addresses, so a crafted DNS AAAA record can cause the outbound HTTP client to treat an address wrapping an internal destination such as 169.254.169.254 as public. An unauthenticated attacker can use a conversion route with WithDenyPrivateIPs enabled to reach cloud metadata services, and the Chromium URL conversion route can return the internal response as a PDF, potentially exposing cloud credentials. Exploitation requires a deployment whose host routes the relevant IPv6 prefix, such as a dual-stack or NAT64-enabled environment. This issue is fixed in version 8.33.0.

GHSA-86m8-88fq-xfxp — Gotenberg has an SSRF deny-list bypass in IsPublicIP via IPv6 6to4 / NAT64 / site-local prefixes

Affected: Go: github.com/gotenberg/gotenberg/v8

### Summary

`IsPublicIP` in `pkg/gotenberg/outbound.go` incorrectly classifies IPv6 6to4 / NAT64 / deprecated site-local addresses as public IPs, allowing an unauthenticated attacker to reach internal destinations (e.g., cloud metadata services at `169.254.169.254`) via a single crafted DNS AAAA record. This is a variant of CVE-2026-44430 (modelcontextprotocol/registry).

### Details

`IsPublicIP` uses Go stdlib helpers (`IsLoopback`, `IsPrivate`, `IsLinkLocalUnicast`, etc.) to block internal IPs. However, these helpers do not recognize IPv6 prefixes that embed IPv4 addresses:

| Prefix | RFC | Tunnels to | |--------|-----|-----------| | `2002::/16` | RFC 3056 (6to4) | IPv4 in bits 16-47 | | `64:ff9b::/96` | RFC 6052 (NAT64 well-known) | IPv4 in low 32 bits | | `64:ff9b:1::/48` | RFC 8215 (NAT64 local-use) | IPv4 in low 32 bits | | `fec0::/10` | RFC 3879 (deprecated site-local) | internal routing |

`addr.Unmap()` only handles `::ffff:0:0/96` (IPv4-mapped) and has no effect on these prefixes. On dual-stack or NAT64-enabled cloud hosts, the OS kernel transparently routes these addresses to their embedded internal IPv4 destinations.

Vulnerable code (`pkg/gotenberg/outbound.go` L53-69, commit `93d0103`):

```go func IsPublicIP(addr netip.Addr) bool { addr = addr.Unmap() // only handles ::ffff:x.x.x.x switch { case addr.IsLoopback(), addr.IsPrivate(), addr.IsLinkLocalUnicast(), ...: return false } return true // 6to4/NAT64/site-local incorr…