The vulnerability is a regular expression denial of service (ReDoS) that occurs when Gotenberg compiles user-supplied scope patterns without a timeout. Attackers can provide specially crafted patterns that cause the regex engine to enter exponential backtracking, causing worker processes to hang indefinitely. This results in denial of service to all clients of the API, consuming CPU and possibly memory resources. The weakness is reflected in CWE-1333, a regex‑based denial of service.

The issue exists in Gotenberg version 8.29.1 and earlier. Gotenberg is an open‑source API used for document format conversion, and the affected component is the dlclark/regexp2 library used to parse scope patterns for features such as extraHttpHeaders. The vendor product is Gotenberg by thecodingmachine.

The CVSS base score of 8.7 marks the bug as high severity. According to the EPSS data, the probability of exploitation is currently below 1%, and the vulnerability is not listed in the CISA KEV catalog. However, the likely attack vector is remote, exploiting the HTTP API that accepts scope patterns. The attacker would need valid access to the API endpoint and supply a malicious regex; the lack of a timeout allows the worker to be hung until manually restarted.