Login Request a demo
DO
Product
docling-slim
by docling-project · last CVE Oct 5, 2026
9
CVEs
0
On KEV
8.8
Max CVSS
9
New 30D
Vulnerabilities9In the news0Timeline
Severity mix
Critical 0High 3Medium 6Low 0
Severity
All severities9Critical0High3Medium6Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add docling-slim to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-105749
6.5
0%
Oct 5
Docling: Unbounded table rowspan/colspan in HTML, JATS, ODS and BoxNote backends causes CPU/memory exhaustion
Affected: >= 2.92.0, < 2.131.0
CVE-2026-105743
5.8
0%
Oct 5
Docling: SSRF guard bypass in remote resource fetching (DNS rebinding / multi-record resolution; no IP validation in HTML render mode)
Affected: >= 2.91.0, < 2.132.0
CVE-2026-105746
5.3
0%
Oct 5
Docling: KServe v2 OCR engine does not enforce enable_remote_services
Affected: >= 2.83.0, < 2.131.0
CVE-2026-105742
5.3
0%
Oct 5
Docling: Configured HTTP headers sent to every remote image host named by a document
Affected: >= 2.95.0, < 2.132.0
CVE-2026-105748
4.3
0%
Oct 5
Docling: Crafted DoclingDocument JSON embeds local image files into converted output
Affected: >= 2.16.0, < 2.131.0
CVE-2026-105747
4.3
0%
Oct 5
Docling: METS-GBS archive member limit enforced after full member enumeration (memory exhaustion during format detection)
Affected: >= 2.45.0, < 2.131.0
Showing 6