Nixpkgs security tracker

Login with GitHub

⚠️ You are using a production deployment that is still only suitable for demo purposes. Any work done in this might be wiped later without notice.

Suggestions search

Untriaged

Filter by:

With package: python313Packages.gotenberg-client

Found 1 matching suggestions

View:

Compact

Detailed

Permalink CVE-2026-35458

created 1 week, 1 day ago

Gotenberg has a ReDoS via extraHttpHeaders scope feature

Gotenberg is an API for converting document formats. In 8.29.1 and earlier, Gotenberg uses dlclark/regexp2 to compile user-supplied scope patterns without setting a proper timeout. Users with access to features using this logic can hang workers indefinitely.

References

https://github.com/gotenberg/gotenberg/security/advisories/GHSA-fmwg-qcqh-m992 x_refsource_CONFIRM

Affected products

gotenberg

==<= 8.29.1

Matching in nixpkgs

pkgs.gotenberg

Converts numerous document formats into PDF files

nixos-unstable 8.27.0
- nixpkgs-unstable 8.29.1
- nixos-unstable-small 8.29.1
nixos-25.11 8.24.0
- nixos-25.11-small 8.24.0
- nixpkgs-25.11-darwin 8.24.0

pkgs.python312Packages.gotenberg-client

Python client for interfacing with the Gotenberg API

nixos-25.11 0.12.0
- nixos-25.11-small 0.12.0
- nixpkgs-25.11-darwin 0.12.0

pkgs.python313Packages.gotenberg-client

Python client for interfacing with the Gotenberg API

nixos-unstable 0.13.1
- nixpkgs-unstable 0.13.1
- nixos-unstable-small 0.13.1
nixos-25.11 0.12.0
- nixos-25.11-small 0.12.0
- nixpkgs-25.11-darwin 0.12.0

pkgs.python314Packages.gotenberg-client

Python client for interfacing with the Gotenberg API

nixos-unstable 0.13.1
- nixpkgs-unstable 0.13.1
- nixos-unstable-small 0.13.1

Package maintainers

@pyrox0 Pyrox <pyrox@pyrox.dev>
@leona-ya Leona Maroni <nix@leona.is>

1