CVE-2026-44018

HighCVSS 7.1/10Last modified Oct 25, 2026

Description

Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.45.0 until 2.91.0, the METS-GBS backend's XML parsing and the input document format detection lacked security controls. An attacker could craft malicious METS-GBS archives that, when processed, could read sensitive files, exhaust system resources, or cause application crashes. This vulnerability is fixed in 2.91.0.

Metrics

CVSS 3.1 7.1/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H

Weakness enumeration

CWE-409 CWE-611 CWE-776

Affected software

Vendor	Product	Versions
docling-project	docling	>= 2.45.0, < 2.91.0

References

https://github.com/docling-project/docling/releases/tag/v2.91.0Release Notes
https://github.com/docling-project/docling/security/advisories/GHSA-r3xg-rg9j-67fvPatch, Vendor Advisory

Timeline

Published: Jun 26, 2026
Last modified: Oct 25, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-440198.1Docling Core defines core data types and transformations for the document processing application Docling. In versions 2.5.0 and above, prior CVE-2026-440207.5Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.13.0 u CVE-2026-440225.5Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.73.0 u CVE-2026-440238.6Docling Core defines core data types and transformations for the document processing application Docling. In versions 1.5.0 and above, prior CVE-2026-440249.8Fluentd collects events from various data sources and writes them to files, RDBMS, NoSQL, IaaS, SaaS, Hadoop and so on. Prior to 1.19.3, Flu CVE-2026-440257.5Fluentd collects events from various data sources and writes them to files, RDBMS, NoSQL, IaaS, SaaS, Hadoop and so on. Prior to 1.19.3, Flu CVE-2026-440287.5An issue was discovered in Nix before 2.34.7 and Lix before 2.95.2. Unbounded recursion in the NAR (Nix Archive) parser could lead to a stac CVE-2026-440295.3An issue was discovered in Nix before 2.34.7. Writing to arbitrary files can occur via "nix-prefetch-url --unpack" or "nix store prefetch-fi CVE-2026-440317.5Uncontrolled recursion in DcmSequenceOfItems::read() and DcmItem::read() in the dcmdata library of OFFIS DCMTK 3.7.0 allows a remote, unauth CVE-2026-440335.5Uncontrolled recursion in XMLNode::ParseXMLElement() and XMLNode::emptyTheNode() in the bundled XML parser (ofstd/libsrc/ofxml.cc) of OFFIS CVE-2026-440344.4A heap-based out-of-bounds read in DcmRLECodecDecoder::decodeFrame() in dcmdata/libsrc/dcrleccd.cc of OFFIS DCMTK 3.7.0 allows an attacker t CVE-2026-440355.5Uncontrolled recursion in DcmDicomDir::moveRecordToTree() in dcmdata/libsrc/dcdicdir.cc of OFFIS DCMTK 3.7.0 allows an attacker to cause a d