EUVD-2026-92803
GHSA-pc36-qwjq-x68c
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N
Network-reachable but AC:H for the DNS-rebinding timing race; PR:N since no authentication is required; S:C because it reaches internal services; C:L only, as leaked data is restricted to image/screenshot-decodable content with no integrity or availability impact.
Primary rating from Vendor (GitHub_M).
CVSS VectorNVD
Lifecycle Timeline
3Blast Radius
ecosystem impact- 1 pypi packages depend on docling (1 direct, 0 indirect)
- 2 pypi packages depend on docling-slim (1 direct, 1 indirect)
Ecosystem-wide dependent count for version 2.91.0 and other introduced versions.
DescriptionNVD
Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.91.0 until 2.132.0, validate_url_safety in docling/backend/utils/image_resource_loader.py validates a hostname with a single IPv4 lookup and then allows the HTTP client to resolve and parse the original URL again, permitting DNS rebinding, mixed public and internal address records, and backslash authority parser disagreement to reach internal services. HTMLBackendOptions(render_page=True) also allows HTTP and HTTPS browser requests without validating their resolved destination. Exploitation requires remote fetching to be enabled, and response content is exposed only when it is decoded as an image or passively rendered in a page screenshot. This issue is fixed in 2.132.0.
AnalysisAI
Server-side request forgery in Docling 2.91.0 through 2.131.x lets an attacker-supplied document reach internal services whenever remote document fetching is explicitly enabled, because validate_url_safety in docling/backend/utils/image_resource_loader.py performs only a single IPv4 lookup before the HTTP client re-resolves and parses the original URL. The same trust gap applies to HTMLBackendOptions(render_page=True), which issues HTTP and HTTPS browser requests without validating their resolved destination, so exploitation also covers DNS rebinding, mixed public/internal address records, and backslash-authority parser disagreement. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation is gated by non-default configuration: remote fetching must be explicitly enabled (e.g. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine but low-urgency issue, not a high-priority emergency. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to Docling 2.132.0, which is the vendor-released fix for this issue and incorporates pull request 4420 (commit 5e469137f275ffc443306a30d12a3a45bceb80fb) as described in advisory GHSA-pc36-qwjq-x68c and the v2.132.0 release notes; if upgrading is not immediately possible, the highest-value compensating control is to leave remote fetching disabled, i.e. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Docling Slim
View allLocal file disclosure in Docling allows crafted HTML to embed readable files from the host filesystem into the rendered
Docling 2.94.0 through 2.131.x allows an attacker-supplied LaTeX/TikZ document to read files accessible to the converter
Import-time code execution in Docling 2.27.0 through 2.131.0 lets any distribution already present in the same Python en
Unbounded rowspan/colspan attribute handling in Docling 2.0.0 through 2.130.x lets a deliberately crafted document force
Docling 2.83.0 through 2.130.x ignores the enable_remote_services=False policy when OCR is configured with KserveV2OcrOp
Docling's HTML backend forwards operator-configured HTTP headers - bearer tokens, API keys, cookies set via HTMLBackendO
Processing a crafted document with Docling (or the docling-slim distribution) versions 2.45.0 through 2.130.x can exhaus
Information disclosure in Docling (and the docling-slim distribution) versions 2.16.0 through 2.130.x lets an attacker e
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today