Nixpkgs security tracker

Login with GitHub

Details of issue NIXPKGS-2026-0983

NIXPKGS-2026-0983

GitHub issue published on

Permalink CVE-2026-35458

updated 3 weeks, 4 days ago by @LeSuisse Activity log

Created suggestion 3 weeks, 5 days ago
@LeSuisse ignored
3 packages
- python312Packages.gotenberg-client
- python313Packages.gotenberg-client
- python314Packages.gotenberg-client
3 weeks, 4 days ago
@LeSuisse accepted 3 weeks, 4 days ago
@LeSuisse published on GitHub 3 weeks, 4 days ago

Gotenberg has a ReDoS via extraHttpHeaders scope feature

Gotenberg is an API for converting document formats. In 8.29.1 and earlier, Gotenberg uses dlclark/regexp2 to compile user-supplied scope patterns without setting a proper timeout. Users with access to features using this logic can hang workers indefinitely.

References

https://github.com/gotenberg/gotenberg/security/advisories/GHSA-fmwg-qcqh-m992 x_refsource_CONFIRM

Affected products

gotenberg

==<= 8.29.1

Matching in nixpkgs

pkgs.gotenberg

Converts numerous document formats into PDF files

nixos-unstable 8.27.0
- nixpkgs-unstable 8.29.1
- nixos-unstable-small 8.29.1
nixos-25.11 8.24.0
- nixos-25.11-small 8.24.0
- nixpkgs-25.11-darwin 8.24.0

Ignored packages (3)

pkgs.python312Packages.gotenberg-client

Python client for interfacing with the Gotenberg API

nixos-25.11 0.12.0
- nixos-25.11-small 0.12.0
- nixpkgs-25.11-darwin 0.12.0

pkgs.python313Packages.gotenberg-client

Python client for interfacing with the Gotenberg API

nixos-unstable 0.13.1
- nixpkgs-unstable 0.13.1
- nixos-unstable-small 0.13.1
nixos-25.11 0.12.0
- nixos-25.11-small 0.12.0
- nixpkgs-25.11-darwin 0.12.0

pkgs.python314Packages.gotenberg-client

Python client for interfacing with the Gotenberg API

nixos-unstable 0.13.1
- nixpkgs-unstable 0.13.1
- nixos-unstable-small 0.13.1

Package maintainers

@pyrox0 Pyrox <pyrox@pyrox.dev>