CVE-2026-105749 (GCVE-0-2026-105749)
Vulnerability from cvelistv5
Published
2026-10-05 21:36
Modified
2026-10-08 02:29
Severity ?
VLAI Severity ?
EPSS score ?
CWE
Summary
Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.0.0 until 2.131.0, the HTML, JATS, OpenDocument spreadsheet, and BoxNote backends, including docling/backend/html_backend.py, docling/backend/jats_backend.py, and docling/backend/boxnote_backend.py, accept the rowspan and colspan attribute values without an upper bound and execute loops or allocate a table grid proportional to the declared span. A very small document can therefore cause sustained CPU use or multi-gigabyte memory allocation, and the document_timeout setting does not interrupt the single backend conversion call. Export through the TableData.grid property can further materialize the oversized grid. This issue is fixed in 2.131.0.
References
| URL | Tags | |||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| docling-project | docling |
Version: >= 2.0.0, < 2.131.0 |
|||||||
|
|||||||||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-105749",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-08T02:28:41.797887Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-08T02:29:09.184Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/docling-project/docling/security/advisories/GHSA-cgc7-9qp3-86m3"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "docling",
"vendor": "docling-project",
"versions": [
{
"status": "affected",
"version": "\u003e= 2.0.0, \u003c 2.131.0"
}
]
},
{
"product": "docling-slim",
"vendor": "docling-project",
"versions": [
{
"status": "affected",
"version": "\u003e= 2.92.0, \u003c 2.131.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.0.0 until 2.131.0, the HTML, JATS, OpenDocument spreadsheet, and BoxNote backends, including docling/backend/html_backend.py, docling/backend/jats_backend.py, and docling/backend/boxnote_backend.py, accept the rowspan and colspan attribute values without an upper bound and execute loops or allocate a table grid proportional to the declared span. A very small document can therefore cause sustained CPU use or multi-gigabyte memory allocation, and the document_timeout setting does not interrupt the single backend conversion call. Export through the TableData.grid property can further materialize the oversized grid. This issue is fixed in 2.131.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "CWE-400: Uncontrolled Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-789",
"description": "CWE-789: Memory Allocation with Excessive Size Value",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-05T21:36:53.431Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/docling-project/docling/security/advisories/GHSA-cgc7-9qp3-86m3",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/docling-project/docling/security/advisories/GHSA-cgc7-9qp3-86m3"
},
{
"name": "https://github.com/docling-project/docling/pull/4414",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/docling-project/docling/pull/4414"
},
{
"name": "https://github.com/docling-project/docling/commit/c5b4429cc6500a344c13edeb22e67610c2159b09",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/docling-project/docling/commit/c5b4429cc6500a344c13edeb22e67610c2159b09"
},
{
"name": "https://github.com/docling-project/docling/releases/tag/v2.131.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/docling-project/docling/releases/tag/v2.131.0"
}
],
"source": {
"advisory": "GHSA-cgc7-9qp3-86m3",
"discovery": "UNKNOWN"
},
"title": "Docling: Unbounded table rowspan/colspan in HTML, JATS, ODS and BoxNote backends causes CPU/memory exhaustion"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-105749",
"datePublished": "2026-10-05T21:36:53.431Z",
"dateReserved": "2026-10-05T19:11:07.947Z",
"dateUpdated": "2026-10-08T02:29:09.184Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-105749\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-10-08T02:28:41.797887Z\"}}}], \"references\": [{\"url\": \"https://github.com/docling-project/docling/security/advisories/GHSA-cgc7-9qp3-86m3\", \"tags\": [\"exploit\"]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-10-08T02:29:01.421Z\"}}], \"cna\": {\"title\": \"Docling: Unbounded table rowspan/colspan in HTML, JATS, ODS and BoxNote backends causes CPU/memory exhaustion\", \"source\": {\"advisory\": \"GHSA-cgc7-9qp3-86m3\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 6.5, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"REQUIRED\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"NONE\"}}], \"affected\": [{\"vendor\": \"docling-project\", \"product\": \"docling\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003e= 2.0.0, \u003c 2.131.0\"}]}, {\"vendor\": \"docling-project\", \"product\": \"docling-slim\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003e= 2.92.0, \u003c 2.131.0\"}]}], \"references\": [{\"url\": \"https://github.com/docling-project/docling/security/advisories/GHSA-cgc7-9qp3-86m3\", \"name\": \"https://github.com/docling-project/docling/security/advisories/GHSA-cgc7-9qp3-86m3\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://github.com/docling-project/docling/pull/4414\", \"name\": \"https://github.com/docling-project/docling/pull/4414\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/docling-project/docling/commit/c5b4429cc6500a344c13edeb22e67610c2159b09\", \"name\": \"https://github.com/docling-project/docling/commit/c5b4429cc6500a344c13edeb22e67610c2159b09\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/docling-project/docling/releases/tag/v2.131.0\", \"name\": \"https://github.com/docling-project/docling/releases/tag/v2.131.0\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.0.0 until 2.131.0, the HTML, JATS, OpenDocument spreadsheet, and BoxNote backends, including docling/backend/html_backend.py, docling/backend/jats_backend.py, and docling/backend/boxnote_backend.py, accept the rowspan and colspan attribute values without an upper bound and execute loops or allocate a table grid proportional to the declared span. A very small document can therefore cause sustained CPU use or multi-gigabyte memory allocation, and the document_timeout setting does not interrupt the single backend conversion call. Export through the TableData.grid property can further materialize the oversized grid. This issue is fixed in 2.131.0.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-400\", \"description\": \"CWE-400: Uncontrolled Resource Consumption\"}]}, {\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-789\", \"description\": \"CWE-789: Memory Allocation with Excessive Size Value\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2026-10-05T21:36:53.431Z\"}}}",
"cveMetadata": "{\"cveId\": \"CVE-2026-105749\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-10-08T02:29:09.184Z\", \"dateReserved\": \"2026-10-05T19:11:07.947Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2026-10-05T21:36:53.431Z\", \"assignerShortName\": \"GitHub_M\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…