Is CVE-2026-42592 actively exploited?

No active exploitation of CVE-2026-42592 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-42592 be exploited remotely?

Yes. CVE-2026-42592 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2026-42592?

CVE-2026-42592 has a CVSS score of 5.3 (MEDIUM).

HOME VULNERABILITIESCVE-2026-42592

MEDIUM

CVE-2026-42592

CWE-367Published: May 14, 2026· Updated: May 18, 2026

5.3

CVSS v3.1

EPSS:0.03%probability of exploitation in 30 daysPercentile:7.4th

Official Description

Gotenberg is a Docker-powered stateless API for PDF files. Prior to 8.32.0, FilterOutboundURL resolves the hostname, checks the resolved IPs against the private-address deny-list, and returns only the error. It discards the resolved addresses. Chromium later performs its own DNS resolution when it navigates to the URL. An attacker who controls DNS for a hostname with a short TTL returns a public IP on the first query (Gotenberg allows) and a private IP on the second query (Chromium connects to the attacker-chosen internal address). The CDP Fetch.requestPaused handler re-checks the URL but runs its own DNS resolution, leaving a timing window before Chromium's actual TCP connect. The rendered internal service response returns to the caller as a PDF. This vulnerability is fixed in 8.32.0.

NVD Source

Technical Analysis

CVE-2026-42592 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.