CVE-2026-35458

Gotenberg versions 8.29.1 and earlier contain a regular expression denial of service (ReDoS) vulnerability in their document format conversion API. The flaw exists in the dlclark/regexp2 library integration, which fails to enforce timeout constraints when compiling user-supplied scope patterns, allowing attackers to cause indefinite worker hangs. Any user with access to features leveraging this pattern-matching logic can exploit the vulnerability. The vulnerability carries a critical CVSS v3.1 score of 9.8 with a network-based attack vector requiring no authentication, low complexity, and no user interaction. The impact encompasses high severity across confidentiality, integrity, and availability, with successful exploitation resulting in complete denial of service and potential system compromise. This assessment reflects the unrestricted network accessibility and severe consequences of worker unavailability in production environments. There is currently no evidence of active exploitation in the wild, as indicated by the absence from the Known Exploited Vulnerabilities catalog and inactive status on public exploit tracking lists. The EPSS score of 0.0006 indicates low probability of real-world exploitation at this time. However, the critical severity rating and straightforward attack methodology warrant immediate patching, particularly for internet-facing Gotenberg deployments, to prevent potential future exploitation as community awareness increases.