The vulnerability is an unauthenticated denial of service caused by a race condition (CWE‑362) where an echo.Context object from a sync.Pool is reused by an async goroutine in the webhook middleware. When the original request handler returns an error, the context is recycled; however, the goroutine may still hold a reference to it. If the context has been reset by another request, a nil store entry is accessed and a panic occurs outside of any recover() scope, terminating the Gotenberg process. The crash manifests as a service outage, requiring a restart of the application to resume operation.

The impact applies to the Gotenberg Docker-powered stateless API for PDF generation. Any Gotenberg installation running a version earlier than 8.32.0 is vulnerable. The vendor identified in the advisory is Gotenberg, with the product commonly deployed under the name Gotenberg.

The CVSS score of 7.5 indicates a medium to high severity for denial of service. The EPSS score is not available, so the current exploitation probability is unknown, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, an attacker can trigger the crash by sending a small burst of concurrent webhook notifications (approximately 24) combined with a moderate number of GET /version requests, which can happen with roughly two seconds of stress. The attack requires no authentication and can be performed from any network source that can reach the exposed webhook endpoint.