CVE-2026-42592

Katalog CVE

CVSS 5.3 · Medium EPSS 0,25%

Kerentanan Time-of-check Time-of-use (TOCTOU) Race Condition pada thecodingmachine gotenberg. Skor CVSS 3.1 5.3 (Medium) menurut github.com.

Deskripsi (NVD)

Gotenberg is a Docker-powered stateless API for PDF files. Prior to 8.32.0, FilterOutboundURL resolves the hostname, checks the resolved IPs against the private-address deny-list, and returns only the error. It discards the resolved addresses. Chromium later performs its own DNS resolution when it navigates to the URL. An attacker who controls DNS for a hostname with a short TTL returns a public IP on the first query (Gotenberg allows) and a private IP on the second query (Chromium connects to the attacker-chosen internal address). The CDP Fetch.requestPaused handler re-checks the URL but runs its own DNS resolution, leaving a timing window before Chromium's actual TCP connect. The rendered internal service response returns to the caller as a PDF. This vulnerability is fixed in 8.32.0.

Rincian

Terbit di NVD

14 Mei 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

5.3 (Medium), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition
CWE-918: Server-Side Request Forgery (SSRF)

EPSS (30 hari)

0,25% peluang dieksploitasi; lebih tinggi dari 15,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/gotenberg/gotenberg/security/advisories/GHSA-2pmr-289p-44r3 exploit · mitigasi · advisory vendor