CVE-2026-126799: Gotenberg 8.31.0 before 8.38.0 SSRF via IPv6 Zone Identifiers in IsPublicIP

Published Nov 11, 2026

Updated

Gotenberg 8.31.0 before 8.38.0 contains a server-side request forgery vulnerability in IsPublicIP() that allows unauthenticated attackers to bypass private-IP deny-list protections using IPv6 zone identifiers. Attackers can append a zone such as %25eth0 to the unspecified address or blocked IPv6 prefixes in downloadFrom, webhook, or Chromium/LibreOffice URLs to reach internal services and read responses in the returned PDF.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Gotenberg to a version that resolves this vulnerability.
Fixed in 8.38.0

Event History

Nov 11, 2026

CVE Published

via MITRE·08:53 PM

Data Sourced

via MITRE·08:53 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·09:16 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed?

Gotenberg versions 8.31.0 through versions before 8.38.0 are affected where attackers can supply URLs through downloadFrom, webhook, or Chromium/LibreOffice URL processing. The issue is reachable without authentication.

What does an attacker need to exploit this?

An attacker needs the ability to provide a URL to one of the affected URL-handling paths. They can append an IPv6 zone identifier, such as %25eth0, to the unspecified address or blocked IPv6 prefixes to bypass private-IP deny-list checks.

What is the likely impact of successful exploitation?

An attacker can make the Gotenberg server request internal services that should be protected by the private-IP deny list. Responses can be read in the generated PDF.

What should be done to remediate the issue?

Upgrade Gotenberg to version 8.38.0 or later. The affected versions are 8.31.0 through versions before 8.38.0.

CVE-2026-126799: Gotenberg 8.31.0 before 8.38.0 SSRF via IPv6 Zone Identifiers in IsPublicIP

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed?

What does an attacker need to exploit this?

What is the likely impact of successful exploitation?

What should be done to remediate the issue?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed?

What does an attacker need to exploit this?

What is the likely impact of successful exploitation?

What should be done to remediate the issue?