CVE-2026-105747: Docling memory exhaustion in METS-GBS tar archive processing

CVE-2026-105747 · Severity: medium · CVSS 4.3 · Published 2026-10-05

Docling is a document processing library that parses various file formats for use with AI systems. A specially crafted gzip-compressed tar archive with many empty members can exhaust application memory during document format detection, even before security restrictions are applied. An attacker could trigger this by submitting a malicious archive file, causing the application to crash or become unresponsive.

Technologies: IBM Docling, docling (PyPI), docling-slim (PyPI). Vendors: IBM, PyPI.

Quick answers

Is CVE-2026-105747 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-105747 being exploited in the wild.
How severe is CVE-2026-105747?
Medium severity, with a CVSS score of 4.3, published 5 October 2026.
Which products and versions are affected?
IBM Docling 2.45.0 to 2.130.x; docling (PyPI) >= 2.45.0, < 2.131.0, ECOSYSTEM:introduced=2.45.0,fixed=2.131.0; docling-slim (PyPI) >= 2.92.0, < 2.131.0, ECOSYSTEM:introduced=2.92.0,fixed=2.131.0.
Is there a fix for CVE-2026-105747?
Yes. docling (PyPI): upgrade to 2.131.0 or later; docling-slim (PyPI): upgrade to 2.131.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-105747 attacked?
It is attacked over the network.
Am I affected by CVE-2026-105747?
Check whether you run IBM Docling, docling (PyPI) or docling-slim (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • docling (PyPI): upgrade to 2.131.0 or later
    pip install "docling>=2.131.0"
  • docling-slim (PyPI): upgrade to 2.131.0 or later
    pip install "docling-slim>=2.131.0"

Technical details

The vulnerability exists in the METS-GBS format detection and backend processing in docling/datamodel/document.py and docling/backend/mets_gbs_backend.py. The code calls tarfile.TarFile.getmembers() before enforcing max_member_count limits, which loads the entire tar member list into memory upfront. An attacker can craft a small gzip-compressed tar archive declaring a very large member count but containing mostly empty members, consuming memory proportional to the declared count. The issue is exploitable during format detection via network submission of METS-GBS archives and is a residual weakness from a prior CVE-2026-44018 fix.

Affected products

  • IBM Docling 2.45.0 to 2.130.x

Identifiers

  • CVE-2026-105747
  • GHSA-3cr3-8m4c-fpxw
  • PYSEC-2026-4194
  • PYSEC-2026-4209

Timeline

  • 2026-10-05: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.