Is CVE-2026-44018 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-44018 being exploited in the wild.

How severe is CVE-2026-44018?

Medium severity, with a CVSS score of 5.5, published 26 June 2026.

Which products and versions are affected?

docling (PyPI) ECOSYSTEM:introduced=2.45.0,fixed=2.91.0.

Is there a fix for CVE-2026-44018?

Yes. docling (PyPI): upgrade to 2.91.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-44018 attacked?

It is attacked with local access, in a software library.

Am I affected by CVE-2026-44018?

Check whether you run docling (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-44018: Docling XXE and resource exhaustion in METS-GBS backend

CVE-2026-44018 · Severity: medium · CVSS 5.5 · Published 2026-06-26

Docling, a tool used to process documents for AI applications, contains a security flaw in how it handles certain archive and XML file formats. An attacker could provide a specially crafted document that, when processed, causes the application to crash, exhaust system memory, or potentially expose sensitive local files. This could lead to service outages or data leaks in automated document processing pipelines.

Technologies: docling (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-44018 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-44018 being exploited in the wild.
How severe is CVE-2026-44018?: Medium severity, with a CVSS score of 5.5, published 26 June 2026.
Which products and versions are affected?: docling (PyPI) ECOSYSTEM:introduced=2.45.0,fixed=2.91.0.
Is there a fix for CVE-2026-44018?: Yes. docling (PyPI): upgrade to 2.91.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-44018 attacked?: It is attacked with local access, in a software library.
Am I affected by CVE-2026-44018?: Check whether you run docling (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

docling (PyPI): upgrade to 2.91.0 or later
```
pip install "docling>=2.91.0"
```

Technical details

The METS-GBS backend in Docling lacked sufficient security controls for XML parsing and archive extraction. Specifically, the XML parser did not disable external entity resolution or DTD loading, leading to potential XXE vulnerabilities (CWE-611, CWE-776). Additionally, the input document format detection and extraction process lacked limits on file size and member counts, making it susceptible to decompression bombs (CWE-409) and resource exhaustion. An attacker can exploit this by providing a malicious METS-GBS archive that requires a user or automated process to trigger parsing. The vulnerability is fixed in version 2.91.0 by implementing secure XML parsing defaults and strict extraction limits (300MB total, 10MB per file).

Affected products

docling-project Docling >= 2.45.0, < 2.91.0

Identifiers

CVE-2026-44018
GHSA-r3xg-rg9j-67fv
PYSEC-2026-2144

Timeline

2026-04-23: patched: Version 2.91.0 released
2026-06-02: advisory: GitHub Security Advisory published
2026-06-26: disclosed: CVE published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.