PT-2026-39617 · Docling · Docling

Published 2026-05-11 · Updated 2026-05-11 · CVE-2026-31247

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Docling versions prior to 2.61.1

Description The JATS XML backend is susceptible to XML Entity Expansion (XXE), a type of attack where an XML parser is tricked into processing entities that expand exponentially. This occurs because the backend utilizes the etree.parse() function to process XML files without disabling entity resolution. A remote attacker can provide a specially crafted XML file containing a nested entity expansion payload, commonly known as an XML Bomb, which causes excessive resource consumption and leads to a denial of service (DoS) condition.

Recommendations Update to a version later than 2.61.0. As a temporary workaround, restrict the processing of untrusted XML files by the JATS XML backend until the update is applied.

Fix

DoS

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

CVE-2026-31247

GHSA-CR42-RG2M-MQ4Q

Affected Products

Docling

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-31247 · Security Note
• https://osv.dev/vulnerability/GHSA-cr42-rg2m-mq4q · Vendor Advisory
• https://github.com/docling-project/docling · Note
• https://twitter.com/VulmonFeeds/status/2053971950637060386 · Twitter Post
• https://twitter.com/CVEnew/status/2053954540529971704 · Twitter Post
• https://notion.so/CVE-2026-31247-35d1e1393188818fa654c116c6a470bb · Note