BentoPDF versions through 2.8.6 allow a client who can control DNS to perform a DNS-over-HTTPS safety check for a URL that resolves to a public address, and later trigger an outbound fetch that resolves to a private or link‑local address. The timing and path checks permit the attacker to supply a certificate, OCSP, CRL, or TSA URL that passes initial validation but later resolves to an internal resource. The proxy fetches the internal data and returns the allowed response body to the attacker, thus providing internal network disclosure. This flaw is an instance of TOCTOU race conditions (CWE-367) and Server‑Side Request Forgery (CWE-918).

The vendor is alam00000, product is BentoPDF. All releases from the start through version 2.8.6 are affected. The issue was fixed in release 2.8.7, which removes the unsafe DNS rebinding check.

The CVSS score of 6.8 indicates a moderate severity. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires precise timing and the attacker must control DNS for the target domain, and the victim must use a deployment where PROXY_SECRET validation is not enabled. The attack vector is likely a direct client performing DNS rebinding; however, network reachability and the need for a favorable timing window reduce the overall likelihood, though the potential impact of internal data exposure remains significant.