Gotenberg's URL conversion route uses Chromium to fetch external content. The FilterOutboundURL step resolves the hostname but then discards the resolved addresses. Chromium performs its own DNS lookup when navigating to the URL, and a malicious attacker can return a public IP on the first lookup and a private IP on the second. Because the CDP Fetch.requestPaused handler only rechecks the URL but performs a new DNS resolution, there's a timing gap that allows the Chromium process to connect to an attacker‑controlled internal address and fetch internal content. The internal response is returned as a PDF to the requester. This demonstrates a server‑side request forgery that bypasses the intended outbound URL filter. The weakness aligns with CWE‑918 (SSRF) and CWE‑367 (DNS rebinding).

The affected product is Gotenberg (the Docker‑based PDF generation service). All versions earlier than 8.32.0 are vulnerable. No specific sub‑versions are listed; the remedy is to upgrade to 8.32.0 or later, where the FilterOutboundURL validation has been corrected to use the resolved IPs retained from the initial DNS lookup.

The CVSS score is 5.3, indicating moderate severity. Exploitation requires controlling the DNS records for a domain with a short TTL and causing the service to perform two separate lookups, which is generally feasible for an attacker with DNS hosting privileges. Although the EPSS score is not available and the vulnerability is not in CISA's KEV catalog, the presence of a small timing window makes the attack more likely only when the attacker can reliably manipulate the resolution order. Because the product is stateless, the vulnerability does not cause a denial of service, but it enables internal network reconnaissance and potential data exposure.