Medium severity · published Oct 5, 2026
CVE-2026-105749
Docling: Unbounded table rowspan/colspan in HTML, JATS, ODS and BoxNote backends causes CPU/memory exhaustion
6.5
CVSS
0.3%
EPSS
No
On KEV
Description
Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.0.0 until 2.131.0, the HTML, JATS, OpenDocument spreadsheet, and BoxNote backends, including docling/backend/html_backend.py, docling/backend/jats_backend.py, and docling/backend/boxnote_backend.py, accept the rowspan and colspan attribute values without an upper bound and execute loops or allocate a table grid proportional to the declared span. A very small document can therefore cause sustained CPU use or multi-gigabyte memory allocation, and the document_timeout setting does not interrupt the single backend conversion call. Export through the TableData.grid property can further materialize the oversized grid. This issue is fixed in 2.131.0.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 22% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DO
docling · docling-project
>= 2.0.0, < 2.131.0 · source: vendor, NVD
DO
docling-slim · docling-project
>= 2.92.0, < 2.131.0 · source: vendor
Affected product
DO
docling
docling-project
More from docling
8.8
CVE-2026-105744
Docling: Arbitrary file read/write (and command execution when shell-escape is enabled) when rendering untrusted TikZ with the opt-in Tectonic engine
8.2
CVE-2026-44016
Docling: Unsafe Playwright-based HTML Rendering
7.8
CVE-2026-105745
Docling: Plugin entry points are imported before the allow_external_plugins check
7.5
CVE-2026-105751
Docling: Arbitrary local file read via draw:image xlink:href in the OpenDocument backend
7.5
CVE-2026-105750
Docling: `enable_local_fetch` is not enforced in HTML browser-rendering mode