{"id":"CVE-2026-126799","summary":"Gotenberg 8.31.0 before 8.38.0 SSRF via IPv6 Zone Identifiers in IsPublicIP","details":"Gotenberg 8.31.0 before 8.38.0 contains a server-side request forgery vulnerability in IsPublicIP() that allows unauthenticated attackers to bypass private-IP deny-list protections using IPv6 zone identifiers. Attackers can append a zone such as %25eth0 to the unspecified address or blocked IPv6 prefixes in downloadFrom, webhook, or Chromium/LibreOffice URLs to reach internal services and read responses in the returned PDF.","aliases":["GHSA-fqg9-x2xw-5crx"],"modified":"2026-11-13T02:47:25.691307442Z","published":"2026-11-11T20:53:03.948Z","database_specific":{"cna_assigner":"VulnCheck","cwe_ids":["CWE-918"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/126xxx/CVE-2026-126799.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/126xxx/CVE-2026-126799.json"},{"type":"ADVISORY","url":"https://github.com/gotenberg/gotenberg/releases/tag/v8.38.0"},{"type":"ADVISORY","url":"https://github.com/gotenberg/gotenberg/security/advisories/GHSA-fqg9-x2xw-5crx"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126799"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/gotenberg-8.31.0-before-8.38.0-ssrf-via-ipv6-zone-identifiers-in-ispublicip"},{"type":"FIX","url":"https://github.com/gotenberg/gotenberg/commit/8e850b1c932452627fba397f2005dd6fd57b9617"},{"type":"ARTICLE","url":"https://github.com/gotenberg/gotenberg/blob/v8.37.0/pkg/gotenberg/outbound.go#L112-L142"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/gotenberg/gotenberg","events":[{"introduced":"db51f9026d13357aecc23e3c99ba6937ac09fbfc"},{"fixed":"e4ee0f29d648f8d5a0a766dd797d108361905deb"},{"fixed":"8e850b1c932452627fba397f2005dd6fd57b9617"}],"database_specific":{"extracted_events":[{"range":[{"introduced":"8.31.0"},{"fixed":"8.38.0"}],"source":"AFFECTED_FIELD","strategy":"StandardRange"},{"source":"REFERENCES_COMMIT","range":[{"fixed":"8e850b1c932452627fba397f2005dd6fd57b9617"}]},{"source":"REFERENCES_TAG","original_tag":"v8.38.0","range":[{"fixed":"e4ee0f29d648f8d5a0a766dd797d108361905deb"}]}]}}],"versions":["v8.37.0","v8.36.0","v8.35.0","v8.34.0","v8.33.0","v8.32.0","v8.31.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-126799.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:L/SA:N"}]}