EUVD-2026-29055
GHSA-cr42-rg2m-mq4q
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
A crafted file parsed by a network-facing ingestion service needs no auth or interaction (AV:N/PR:N/UI:N), is trivial to build (AC:L), and only exhausts resources (C:N/I:N/A:H).
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
Docling's JATS XML backend is vulnerable to XML Entity Expansion (XXE) attacks thru 2.61.0. The backend uses etree.parse() to parse XML files without disabling entity resolution. An attacker can craft a malicious XML file containing a nested entity expansion payload (XML Bomb). When processed by Docling, the exponential expansion of entities leads to excessive resource consumption, resulting in a denial of service (DoS) condition on the system running the Docling parser.
AnalysisAI
Denial of service in Docling through version 2.61.0 lets remote attackers crash or exhaust resources on any system that parses a document via the JATS XML backend. The backend calls etree.parse() without disabling entity resolution, so a maliciously crafted JATS/XML file containing nested entity definitions (a 'billion laughs' XML bomb) triggers exponential entity expansion and consumes all available CPU/memory. No public exploit identified at time of analysis; EPSS is very low (0.02%) and SSVC records no observed exploitation, so this is a high-CVSS availability issue rather than an actively exploited threat.
Technical ContextAI
Docling is an open-source Python document-conversion library that ingests many formats, including JATS (Journal Article Tag Suite) XML used for scientific/journal articles, and here the JATS backend uses lxml's etree.parse() with default settings that permit DTD processing and internal general entity resolution. The root cause is CWE-400 (Uncontrolled Resource Consumption) realized through the classic XML Entity Expansion / 'billion laughs' pattern: a small file declares entities that reference other entities recursively, so a linear input expands exponentially in memory during parse. Because lxml is not configured with resolve_entities=False / no_network=True or a hardened parser (e.g. defusedxml), the expansion proceeds unchecked. Note this is entity-expansion DoS specifically - despite the 'XXE' label in the description and tags, the described impact is resource exhaustion (A:H), not external file/SSRF data exfiltration (which would show C impact).
RemediationAI
No vendor-released patched version is independently confirmed from the provided data - the references point to the project repository and NVD/Notion writeups, not a tagged release - so treat fixed-version claims cautiously and check https://github.com/docling-project/docling for a release above 2.61.0 before upgrading. As the primary code-level fix, harden XML parsing by disabling DTD/entity processing: parse the JATS input with a hardened parser such as defusedxml, or configure lxml with etree.XMLParser(resolve_entities=False, no_network=True, huge_tree=False) so entity expansion cannot occur (trade-off: documents that legitimately rely on custom entity definitions will fail to parse, which is acceptable for JATS ingestion). As compensating controls until patched, restrict the JATS/XML backend from processing untrusted or user-uploaded files, impose CPU/memory/time limits (ulimit, cgroups, container resource caps, or a parse timeout) on any process running Docling so a bomb payload is bounded rather than fatal, and gate ingestion behind file-size and structure validation. Advisory URLs: https://nvd.nist.gov/vuln/detail/CVE-2026-31247 and https://github.com/docling-project/docling.
LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root
LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Same weakness CWE-400 – Uncontrolled Resource Consumption
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today