Executive brief
Docling, a tool used to process documents for AI applications, contains a security flaw in how it handles certain archive and XML file formats. An attacker could provide a specially crafted document that, when processed, causes the application to crash, exhaust system memory, or potentially expose sensitive local files. This could lead to service outages or data leaks in automated document processing pipelines.
Technical details
The METS-GBS backend in Docling lacked sufficient security controls for XML parsing and archive extraction. Specifically, the XML parser did not disable external entity resolution or DTD loading, leading to potential XXE vulnerabilities (CWE-611, CWE-776). Additionally, the input document format detection and extraction process lacked limits on file size and member counts, making it susceptible to decompression bombs (CWE-409) and resource exhaustion. An attacker can exploit this by providing a malicious METS-GBS archive that requires a user or automated process to trigger parsing. The vulnerability is fixed in version 2.91.0 by implementing secure XML parsing defaults and strict extraction limits (300MB total, 10MB per file).
Affected products
- docling-project Docling >= 2.45.0, < 2.91.0
Timeline
- 2026-04-23: patched: Version 2.91.0 released
- 2026-06-02: advisory: GitHub Security Advisory published
- 2026-06-26: disclosed: CVE published to NVD