Gotenberg is a Docker‑powered stateless API for PDF files. From version 8.10.0 through 8.32.x, the newContext function in pkg/modules/api/context.go starts an errgroup.Go goroutine for each multipart downloadFrom entry and allows those goroutines to concurrently write to the shared ctx.files, ctx.diskToOriginal, and ctx.filesByField maps and slices. Because Go maps and slices are not safe for concurrent mutation, a crafted multipart request containing many downloadFrom entries can trigger a data race that ends the process with a fatal concurrent map writes runtime error. The default configuration, which enables downloadFrom and disables authentication, allows an unauthenticated remote attacker to crash an exposed service and cause a denial of service. This issue is fixed in version 8.33.0.

The vulnerability affects Gotenberg versions 8.10.0 to 8.32.x. The default configuration allows the "downloadFrom" feature while authentication is disabled, meaning an unauthenticated attacker can submit a malicious multipart request to any exposed service. The issue was remedied in version 8.33.0 and later, which removes the concurrent write path.

The CVSS score of 7.5 defines a high‑severity denial‑of‑service vulnerability. The EPSS score is reported as less than 1%, indicating a low probability of exploitation according to current data, yet the impact is severe if exploited. Because the flaw permits unauthenticated users to send a crafted multipart request to any reachable Gotenberg endpoint, it can be triggered remotely without host privileges. The vulnerability is not yet listed in CISA’s KEV catalog. Because no public exploits have been disclosed, the primary risk arises from the inherent flaw rather than known attack tools.