# CVE-2026-105747: Docling memory exhaustion in METS-GBS tar archive processing

Source: https://junglewise.ai/threats/cve-2026-105747-docling-simplifies-document-processing-by-parsing-diverse  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-05. Updated: 2026-10-05  
License: CC BY 4.0 with a link back

CVE-2026-105747 · Severity: medium · CVSS 4.3 · Published 2026-10-05

Docling is a document processing library that parses various file formats for use with AI systems. A specially crafted gzip-compressed tar archive with many empty members can exhaust application memory during document format detection, even before security restrictions are applied. An attacker could trigger this by submitting a malicious archive file, causing the application to crash or become unresponsive.

Technologies: [IBM Docling](https://junglewise.ai/threats/technologies/docling), [docling (PyPI)](https://junglewise.ai/threats/technologies/pypi-docling), [docling-slim (PyPI)](https://junglewise.ai/threats/technologies/docling-slim). Vendors: [IBM](https://junglewise.ai/threats/vendors/ibm), [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-105747 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-105747 being exploited in the wild.

**How severe is CVE-2026-105747?** Medium severity, with a CVSS score of 4.3, published 5 October 2026.

**Which products and versions are affected?** IBM Docling 2.45.0 to 2.130.x; docling (PyPI) >= 2.45.0, < 2.131.0, ECOSYSTEM:introduced=2.45.0,fixed=2.131.0; docling-slim (PyPI) >= 2.92.0, < 2.131.0, ECOSYSTEM:introduced=2.92.0,fixed=2.131.0.

**Is there a fix for CVE-2026-105747?** Yes. docling (PyPI): upgrade to 2.131.0 or later; docling-slim (PyPI): upgrade to 2.131.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-105747 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-105747?** Check whether you run IBM Docling, docling (PyPI) or docling-slim (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- docling (PyPI): upgrade to 2.131.0 or later

  ```sh
  pip install "docling>=2.131.0"
  ```

- docling-slim (PyPI): upgrade to 2.131.0 or later

  ```sh
  pip install "docling-slim>=2.131.0"
  ```


## Technical details

The vulnerability exists in the METS-GBS format detection and backend processing in docling/datamodel/document.py and docling/backend/mets_gbs_backend.py. The code calls tarfile.TarFile.getmembers() before enforcing max_member_count limits, which loads the entire tar member list into memory upfront. An attacker can craft a small gzip-compressed tar archive declaring a very large member count but containing mostly empty members, consuming memory proportional to the declared count. The issue is exploitable during format detection via network submission of METS-GBS archives and is a residual weakness from a prior CVE-2026-44018 fix.

## Affected products

- IBM Docling 2.45.0 to 2.130.x

## Identifiers

- CVE-2026-105747
- GHSA-3cr3-8m4c-fpxw
- PYSEC-2026-4194
- PYSEC-2026-4209

## Timeline

- 2026-10-05: disclosed

## References

- [https://github.com/docling-project/docling/commit/ebae65cd71c37c88b36185b406a449b92d8f7ffa](https://github.com/docling-project/docling/commit/ebae65cd71c37c88b36185b406a449b92d8f7ffa)
- [https://github.com/docling-project/docling/pull/4412](https://github.com/docling-project/docling/pull/4412)

## Related threats

- [Docling METS-GBS archive member limit enforced after full enumeration](https://junglewise.ai/threats/duplicate-advisory-docling-mets-gbs-archive-member-limit-enforced-after-087423a8)
- [Docling arbitrary filesystem read via unvalidated xlink:href in ODF images](https://junglewise.ai/threats/cve-2026-105751-docling-simplifies-document-processing-by-parsing-diverse)
- [Docling local file disclosure in HTML rendering](https://junglewise.ai/threats/cve-2026-105750-docling-simplifies-document-processing-by-parsing-diverse)
- [Docling unbounded table span allocation denial of service](https://junglewise.ai/threats/cve-2026-105749-docling-simplifies-document-processing-by-parsing-diverse)
- [IBM Docling arbitrary local file read via JSON backend](https://junglewise.ai/threats/cve-2026-105748-docling-simplifies-document-processing-by-parsing-diverse)