IPv6 Handling Issue in Gotenberg PDF API by Gotenberg

CVE-2026-45741

What is CVE-2026-45741?

The Gotenberg PDF API is affected by an improper input validation issue that allows an attacker to exploit specific IPv6 address handling flaws. When deployed in environments with enabled IPv6 prefixes such as dual-stack or NAT64, the IsPublicIP function can mistakenly identify internal addresses as public. This misclassification can lead to unauthorized access to sensitive cloud metadata services, particularly allowing attackers to harvest cloud credentials via specially crafted DNS records. The vulnerability has been addressed in version 8.33.0, emphasizing the need for users to upgrade their installations promptly to mitigate risks.

References