# CVE-2026-44018: Docling XXE and resource exhaustion in METS-GBS backend

Source: https://junglewise.ai/threats/cve-2026-44018-docling-xxe-and-resource-exhaustion-in-mets-gbs-backend  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-26. Updated: 2026-06-26  
License: CC BY 4.0 with a link back

CVE-2026-44018 · Severity: medium · CVSS 5.5 · Published 2026-06-26

Docling, a tool used to process documents for AI applications, contains a security flaw in how it handles certain archive and XML file formats. An attacker could provide a specially crafted document that, when processed, causes the application to crash, exhaust system memory, or potentially expose sensitive local files. This could lead to service outages or data leaks in automated document processing pipelines.

Technologies: [docling (PyPI)](https://junglewise.ai/threats/technologies/pypi-docling). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-44018 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-44018 being exploited in the wild.

**How severe is CVE-2026-44018?** Medium severity, with a CVSS score of 5.5, published 26 June 2026.

**Which products and versions are affected?** docling (PyPI) ECOSYSTEM:introduced=2.45.0,fixed=2.91.0.

**Is there a fix for CVE-2026-44018?** Yes. docling (PyPI): upgrade to 2.91.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-44018 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-44018?** Check whether you run docling (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- docling (PyPI): upgrade to 2.91.0 or later

  ```sh
  pip install "docling>=2.91.0"
  ```


## Technical details

The METS-GBS backend in Docling lacked sufficient security controls for XML parsing and archive extraction. Specifically, the XML parser did not disable external entity resolution or DTD loading, leading to potential XXE vulnerabilities (CWE-611, CWE-776). Additionally, the input document format detection and extraction process lacked limits on file size and member counts, making it susceptible to decompression bombs (CWE-409) and resource exhaustion. An attacker can exploit this by providing a malicious METS-GBS archive that requires a user or automated process to trigger parsing. The vulnerability is fixed in version 2.91.0 by implementing secure XML parsing defaults and strict extraction limits (300MB total, 10MB per file).

## Affected products

- docling-project Docling >= 2.45.0, < 2.91.0

## Identifiers

- CVE-2026-44018
- GHSA-r3xg-rg9j-67fv
- PYSEC-2026-2144

## Timeline

- 2026-04-23: patched: Version 2.91.0 released
- 2026-06-02: advisory: GitHub Security Advisory published
- 2026-06-26: disclosed: CVE published to NVD

## References

- [https://github.com/docling-project/docling/releases/tag/v2.91.0](https://github.com/docling-project/docling/releases/tag/v2.91.0)
- [https://github.com/docling-project/docling/security/advisories/GHSA-r3xg-rg9j-67fv](https://github.com/docling-project/docling/security/advisories/GHSA-r3xg-rg9j-67fv)

## Related threats

- [Docling METS-GBS archive member limit enforced after full enumeration](https://junglewise.ai/threats/duplicate-advisory-docling-mets-gbs-archive-member-limit-enforced-after-087423a8)
- [Docling arbitrary filesystem read via unvalidated xlink:href in ODF images](https://junglewise.ai/threats/cve-2026-105751-docling-simplifies-document-processing-by-parsing-diverse)
- [Docling local file disclosure in HTML rendering](https://junglewise.ai/threats/cve-2026-105750-docling-simplifies-document-processing-by-parsing-diverse)
- [Docling unbounded table span allocation denial of service](https://junglewise.ai/threats/cve-2026-105749-docling-simplifies-document-processing-by-parsing-diverse)
- [IBM Docling arbitrary local file read via JSON backend](https://junglewise.ai/threats/cve-2026-105748-docling-simplifies-document-processing-by-parsing-diverse)