CVE-2026-35458

Gotenberg is an API for converting document formats. In 8.29.1 and earlier, Gotenberg uses dlclark/regexp2 to compile user-supplied scope patterns without setting a proper timeout. Users with access to features using this logic can hang workers indefinitely.

• CWE-1333

• https://github.com/gotenberg/gotenberg/security/advisories/GHSA-fmwg-qcqh-m992Exploit, Vendor Advisory

Published

Apr 7, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-35451Twenty is an open source CRM. Prior to 1.20.6, a Stored Cros…5.7
• CVE-2026-35452WWBN AVideo is an open source video platform. In versions 26…5.3
• CVE-2026-35453PhpSpreadsheet is a library for reading and writing spreadsh…5.4
• CVE-2026-35454The Code Extension Marketplace is an open-source alternative…6.5
• CVE-2026-35455immich is a high performance self-hosted photo and video man…5.4
• CVE-2026-35457libp2p-rust is the official rust language Implementation of …8.2
• CVE-2026-35459pyLoad is a free and open-source download manager written in…9.1
• CVE-2026-3546The e-shot form builder plugin for WordPress is vulnerable t…5.3
• CVE-2026-35460Papra is a minimalistic document management and archiving pl…5.4
• CVE-2026-35461Papra is a minimalistic document management and archiving pl…4.3
• CVE-2026-35462Papra is a minimalistic document management and archiving pl…4.3
• CVE-2026-35463pyLoad is a free and open-source download manager written in…8.8