Threats affecting pkg:golang/gotenberg

Gotenberg versions 8.31.0 through 8.37.x contain a server-side request forgery (SSRF) vulnerability in the IsPublicIP() function. This flaw allows unauthenticated attackers to bypass private IP deny-list protections by exploiting IPv6 zone identifiers appended to certain URLs. By appending a zone such as %25eth0 to unspecified or blocked IPv6 addresses in downloadFrom, webhook, or Chromium/LibreOffice URLs, attackers can access internal services and extract data included in generated PDFs. The vulnerability is fixed in version 8.38.0.