DO
Product
docling
16
CVEs
0
On KEV
8.8
Max CVSS
10
New 30D
Severity mix
Critical 0High 9Medium 7Low 0
Watch
Add docling to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-105749 | 6.5 | Oct 5 | Docling: Unbounded table rowspan/colspan in HTML, JATS, ODS and BoxNote backends causes CPU/memory exhaustion Affected: >= 2.0.0, < 2.131.0 |
| CVE-2026-105743 | 5.8 | Oct 5 | Docling: SSRF guard bypass in remote resource fetching (DNS rebinding / multi-record resolution; no IP validation in HTML render mode) Affected: >= 2.91.0, < 2.132.0 |
| CVE-2026-44022 | 5.5 | Jun 24 | Docling: Potential Path Traversal via LaTeX \includegraphics and \input Commands Affected: >= 2.73.0, < 2.91.0 |
| CVE-2026-105746 | 5.3 | Oct 5 | Docling: KServe v2 OCR engine does not enforce enable_remote_services Affected: >= 2.83.0, < 2.131.0 |
| CVE-2026-105742 | 5.3 | Oct 5 | Docling: Configured HTTP headers sent to every remote image host named by a document Affected: >= 2.95.0, < 2.132.0 |
| CVE-2026-105748 | 4.3 | Oct 5 | Docling: Crafted DoclingDocument JSON embeds local image files into converted output Affected: >= 2.16.0, < 2.131.0 |
| CVE-2026-105747 | 4.3 | Oct 5 | Docling: METS-GBS archive member limit enforced after full member enumeration (memory exhaustion during format detection) Affected: >= 2.45.0, < 2.131.0 |
Showing 7