EUVD-2026-92809
GHSA-f4ch-vxwc-3p2m
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Remotely supplied file (AV:N) processed without auth (PR:N) but requires ingestion by a user/pipeline (UI:R); only bounded memory exhaustion, so C:N/I:N and A:L.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
3Blast Radius
ecosystem impact- 2 pypi packages depend on docling-slim (1 direct, 1 indirect)
Ecosystem-wide dependent count for version 2.92.0.
DescriptionCVE.org
Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.45.0 until 2.131.0, METS-GBS format detection in docling/datamodel/document.py and the backend in docling/backend/mets_gbs_backend.py call tarfile.TarFile.getmembers() before enforcing the max_member_count limit, causing the full archive member list to be allocated before the limit can stop processing. A small gzip-compressed tar archive with a very large number of empty members can therefore consume memory proportional to the declared member count, including during format detection before the allowed_formats restriction is applied. This issue is a residual weakness in the member-count protection added for CVE-2026-44018. This issue is fixed in 2.131.0.
AnalysisAI
Processing a crafted document with Docling (or the docling-slim distribution) versions 2.45.0 through 2.130.x can exhaust process memory: a small gzip-compressed tar archive that declares a very large number of empty members causes the full archive member list to be materialised before the configured max_member_count limit can stop processing. The flaw sits in METS-GBS format detection (docling/datamodel/document.py) and the METS-GBS backend (docling/backend/mets_gbs_backend.py), and because detection runs before the allowed_formats restriction is applied, an attacker does not need METS-GBS to be an enabled format - remote, unauthenticated delivery is possible per the CVSS vector (AV:N/PR:N), though a user or automated pipeline must actually submit the file (UI:R), and the resulting impact is limited to availability (A:L, CVSS 4.3) with no code execution or data disclosure. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The target must run Docling (or docling-slim) 2.45.0-2.130.x and ingest an attacker-supplied file through its document pipeline. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a medium-severity, resource-exhaustion (memory amplification) flaw, not a high-priority emergency. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to Docling (and docling-slim) 2.131.0, the version in which the member-count limit is enforced lazily during iteration; the release note is at https://github.com/docling-project/docling/releases/tag/v2.131.0, the advisory at https://github.com/docling-project/docling/security/advisories/GHSA-3cr3-8m4c-fpxw, and the upstream change at https://github.com/docling-project/docling/pull/4412 (commit ebae65cd71c37c88b36185b406a449b92d8f7ffa). … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Docling Slim
View allLocal file disclosure in Docling allows crafted HTML to embed readable files from the host filesystem into the rendered
Docling 2.94.0 through 2.131.x allows an attacker-supplied LaTeX/TikZ document to read files accessible to the converter
Import-time code execution in Docling 2.27.0 through 2.131.0 lets any distribution already present in the same Python en
Unbounded rowspan/colspan attribute handling in Docling 2.0.0 through 2.130.x lets a deliberately crafted document force
Server-side request forgery in Docling 2.91.0 through 2.131.x lets an attacker-supplied document reach internal services
Docling 2.83.0 through 2.130.x ignores the enable_remote_services=False policy when OCR is configured with KserveV2OcrOp
Docling's HTML backend forwards operator-configured HTTP headers - bearer tokens, API keys, cookies set via HTMLBackendO
Information disclosure in Docling (and the docling-slim distribution) versions 2.16.0 through 2.130.x lets an attacker e
Share
External POC / Exploit Code
Leaving vuln.today