PT-2026-39617 · Docling · Docling

Published 2026-05-11 · Updated 2026-05-11 · CVE-2026-31247

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions Docling versions prior to 2.61.1

Description The JATS XML backend is susceptible to XML Entity Expansion (XXE), a type of attack where an XML parser is tricked into processing entities that expand exponentially. This occurs because the backend utilizes the etree.parse() function to process XML files without disabling entity resolution. A remote attacker can provide a specially crafted XML file containing a nested entity expansion payload, commonly known as an XML Bomb, which causes excessive resource consumption and leads to a denial of service (DoS) condition.

Recommendations Update to a version later than 2.61.0. As a temporary workaround, restrict the processing of untrusted XML files by the JATS XML backend until the update is applied.

Related Identifiers

CVE-2026-31247

Affected Products

Docling

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-31247 · Security Note
• https://github.com/docling-project/docling · Note
• https://notion.so/CVE-2026-31247-35d1e1393188818fa654c116c6a470bb · Note
• https://twitter.com/CVEnew/status/2053954540529971704 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2053971950637060386 · Twitter Post