CVE-2026-35458: 
NixOS vulnerability analysis and mitigation

CVE-2026-35458 is a ReDoS (Regular Expression Denial of Service) vulnerability in Gotenberg, an API for converting document formats. In versions 8.29.1 and earlier, Gotenberg uses the dlclark/regexp2 library to compile user-supplied scope patterns without setting a proper timeout, allowing any user with access to affected endpoints to hang workers indefinitely. The vulnerability was published on April 7, 2026, and a patch was released in version 8.30.0. It carries a CVSS v3.1 base score of 9.8 (Critical) and a CVSS v4.0 base score of 8.7 (High) (GitHub Advisory, Red Hat).

The root cause is classified as CWE-1333 (Inefficient Regular Expression Complexity), corresponding to CAPEC-492 (Regular Expression Exponential Blowup). Specifically, in gotenberg/pkg/modules/chromium/routes.go:200, Gotenberg compiles user-supplied scope patterns via dlclark/regexp2 with no MatchTimeout set, defaulting to math.MaxInt64 (effectively "forever"). An attacker can submit a crafted scope pattern — such as a classic nested quantifier pattern like ([a-zA-Z0-9.:/_]+)+\! — via the extraHttpHeaders form field on endpoints like /forms/chromium/screenshot/url, triggering catastrophic backtracking that consumes all CPU cycles on the worker thread. No authentication or special privileges are required to reach the vulnerable endpoint (GitHub Advisory).

Successful exploitation causes Gotenberg worker processes to hang indefinitely, rendering the service completely unavailable to legitimate users — a pure availability impact with no confidentiality or integrity compromise. Because a single malicious request can permanently occupy a worker, repeated requests can exhaust all available workers, causing a full denial of service for the Gotenberg instance and any dependent document conversion workflows. The impact is limited to the Gotenberg service itself and does not facilitate lateral movement or data exfiltration (GitHub Advisory).

A public proof-of-concept Python script is available in the GitHub Security Advisory, demonstrating the ReDoS condition by sending HTTP POST requests with malicious regex patterns in the extraHttpHeaders parameter and measuring response time differences to confirm worker hangs. The vulnerability requires no authentication, no user interaction, and is exploitable over the network with low attack complexity. The EPSS score is approximately 0.042%, and there is no evidence of active in-the-wild exploitation or CISA KEV catalog listing as of the time of reporting (GitHub Advisory).

1. Reconnaissance: Identify internet-facing or internally accessible Gotenberg instances running version 8.29.1 or earlier using network scanning tools or service discovery. Confirm the /forms/chromium/screenshot/url endpoint is reachable.
2. Craft malicious payload: Construct a scope pattern using nested quantifiers that causes catastrophic backtracking in dlclark/regexp2, such as ([a-zA-Z0-9.:/_]+)+\!.
3. Embed pattern in request: Include the malicious pattern in the extraHttpHeaders form field as a JSON-encoded header value with a scope= directive, e.g., {"X-Test": "value; scope=([a-zA-Z0-9.:/_]+)+\!"}.
4. Send HTTP POST request: Submit the crafted multipart form POST request to http://<target>/forms/chromium/screenshot/url with the malicious extraHttpHeaders value and any required url parameter.
5. Worker hang achieved: The Gotenberg worker begins evaluating the regex with no timeout, consuming 100% CPU and becoming unresponsive. Repeating this across multiple workers causes full service denial.
6. Confirm exploitation: Observe that the request times out (e.g., after 15 seconds) while a baseline request with a benign pattern completes normally, confirming the ReDoS condition (GitHub Advisory).

• Network: Repeated HTTP POST requests to /forms/chromium/screenshot/url (or similar Chromium-related endpoints) with extraHttpHeaders values containing complex nested quantifier regex patterns (e.g., ([a-zA-Z0-9.:/_]+)+\!).
• Logs: Gotenberg access logs showing requests to /forms/chromium/screenshot/url that never complete or return a response; requests with unusually long processing times (exceeding normal document conversion durations).
• Process: Gotenberg worker processes consuming 100% CPU for extended periods without completing; worker processes becoming unresponsive and failing to handle subsequent requests.
• Application Behavior: Gotenberg API becoming unresponsive or returning connection timeouts for all requests following one or more requests containing crafted extraHttpHeaders scope patterns (GitHub Advisory).

Upgrade Gotenberg to version 8.30.0 or later, which addresses the vulnerability by setting a proper MatchTimeout on dlclark/regexp2 regex compilation (GitHub Advisory). As interim mitigations, restrict network access to Gotenberg API endpoints so only trusted internal services can reach them, and implement request timeouts at the reverse proxy or load balancer level to limit the duration of any single request. Additionally, monitor for unexplained worker hangs or unresponsive API instances as an early warning signal.

The vulnerability was reported by security researchers beryxz and drw0if and disclosed responsibly through GitHub's security advisory process by Gotenberg maintainer gulien on April 6, 2026. Red Hat has acknowledged the CVE in their security tracking system. No significant broader media coverage or notable community commentary beyond the advisory itself has been identified (GitHub Advisory, Red Hat).