Machine-written summary
Summary written by Claude Haiku from the source advisory. Not reviewed by a person.
GHSA-2pmr-289p-44r3: Gotenberg (github.com/gotenberg/gotenberg/v8) versions up to and including 8.31.0 are affected. The Chromium URL conversion routes check a URL against the private-address deny-list, but a DNS rebinding attack can return a public IP to that check and a private IP to Chromium's later connection. An unauthenticated caller who controls DNS for a hostname can reach services on the container's loopback interface or other private addresses, such as cloud metadata endpoints, and read the response in the generated PDF. No fix is listed.
Not analysed yet
We haven’t published our analysis of this Advisory yet. Once a person has reviewed it, this page will say what’s vulnerable, what has to be true for your app to be affected, and how to check.
Severity and exploitation
| Score | Rating | CVSS | Vector | Source |
|---|---|---|---|---|
| 5.3 | Medium | 3.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N | CNA (GitHub_M) |
- CISA KEV Not listed.
- EPSS 0.0019, the 8th percentile, on 14 Nov 2026: FIRST’s estimate of the chance of exploitation in the next 30 days.
Timeline
- 14 May 2026, 16:16 UTC Confirmed by NVD
- 31 Oct 2026, 14:13 UTC First seen by agentprime
- 31 Oct 2026, 14:13 UTC Confirmed by OSV