High 7.5Published Aug 19, 2026

CVE-2026-45741Gotenberg: SSRF deny-list bypass in IsPublicIP via IPv6 6to4 / NAT64 / site-local prefixes

Updated under an hour ago (2026-10-19 07:10 UTC)

Does this affect you?

It affects gotenberg. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for gotenberg

Exploited in the last 30 days

Gotenberg is a Docker-powered stateless API for PDF files. In 8.32.0 and earlier, the IsPublicIP function in pkg/gotenberg/outbound.go does not reject the 2002::/16 6to4 prefix, the 64:ff9b::/96 and 64:ff9b:1::/48 NAT64 prefixes, the fec0::/10 deprecated site-local prefix, Teredo, and other transition prefixes that can embed or route to non-public IPv4 destinations. The addr.Unmap operation only handles IPv4-mapped IPv6 addresses, so a crafted DNS AAAA record can cause the outbound HTTP client to treat an address wrapping an internal destination such as 169.254.169.254 as public. An unauthenticated attacker can use a conversion route with WithDenyPrivateIPs enabled to reach cloud metadata services, and the Chromium URL conversion route can return the internal response as a PDF, potentially exposing cloud credentials. Exploitation requires a deployment whose host routes the relevant IPv6 prefix, such as a dual-stack or NAT64-enabled environment. This issue is fixed in version 8.33.0.

CVSS: 7.5 HIGH (v3.1, CNA)CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:N
Weakness (CWE): CWE-184, CWE-918
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: GitHub_M
NVD analysis: Deferred
Record last updated: Aug 19, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

gotenberg gotenberg gotenberg:gotenberg (from the name)	before 8.33.0	CNA record

References

https://github.com/gotenberg/gotenberg/security/advisories/GHSA-86m8-88fq-xfxpx-refsource-confirm
https://github.com/gotenberg/gotenberg/commit/f9a01c9fb308372170ab7fc97b17a118ee8a125cx-refsource-misc
https://github.com/gotenberg/gotenberg/releases/tag/v8.33.0x-refsource-misc

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.