Gotenberg, a Docker‑powered stateless API, contains a flaw in versions 8.32.0 and earlier that fails to flag several IPv6 transition prefixes as private. The IsPublicIP logic incorrectly treats prefixes such as 2002::/16 6to4, 64:ff9b::/96 NAT64, 64:ff9b:1::/48, fec0::/10 site‑local, Teredo, and other similar addresses as public. Because the Unmap routine only removes IPv4‑mapped IPv6 addresses, an attacker can craft a DNS AAAAA record that resolves to a wrapped internal address like 169.254.169.254. The outbound HTTP client then believes the destination is public and performs a lookup using the WithDenyPrivateIPs conversion route. If the request passes through the Chromium URL conversion route, the internal response is returned as a PDF, exposing cloud metadata services and credentials. This bypass is only possible when the host routes the relevant IPv6 prefixes, such as in dual‑stack or NAT64 networks. The issue is fixed in the 8.33.0 release.

Any deployment of Gotenberg 8.32.0 or earlier is affected. The issue is confined to the gotenberg:gotenberg container image. Upgrading to version 8.33.0 or later remedies the problem, as the maintainers amended the IsPublicIP logic to block the offending IPv6 prefixes.

The CVSS score of 7.5 categorizes this vulnerability as high severity. The EPSS score of < 1% indicates that the probability of exploitation is very low, but it is not negligible. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires an environment where the host routes the affected IPv6 transition prefixes, typically a dual‑stack or NAT64 deployment, and an attacker who can inject a crafted DNS AAAAA record that maps to a reserved internal address. The likely attack vector is remote network access that triggers the outbound HTTP client to follow a conversion route to cloud metadata services. Although the flaw does not enable arbitrary code execution, it allows an unauthenticated attacker to read sensitive credentials from internal metadata endpoints.