PT-2026-46120 · Docling · Docling

Brodmart · CVE-2026-44018 · Published 2026-06-03 · Updated 2026-06-27

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H

Name of the Vulnerable Software and Affected Versions Docling versions 2.45.0 through 2.90.0

Description The METS-GBS backend's XML parsing and input document format detection lack security controls. This allows for XML External Entity (XXE) attacks, which occur when an XML parser improperly handles external entity references, potentially allowing the reading of local files or causing a denial of service. Additionally, the system is susceptible to decompression bombs (zip bombs), where small archives expand to massive sizes, and unbounded archive extraction, both of which can exhaust memory and disk space or cause application crashes.

Recommendations Update to version 2.91.0. Avoid processing METS-GBS archives from untrusted sources. Pre-validate archives in an isolated environment with resource limits.

Exploit

Fix

XXE

XML Entity Expansion

Weakness Enumeration

CWE-611

CWE-776

CWE-409

Related Identifiers

CVE-2026-44018

GHSA-R3XG-RG9J-67FV

PYSEC-2026-2144

Affected Products

Docling

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/44xxx/CVE-2026-44018.json · Exploit
• https://github.com/docling-project/docling/security/advisories/GHSA-r3xg-rg9j-67fv · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-r3xg-rg9j-67fv · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-44018 · Security Note
• https://osv.dev/vulnerability/PYSEC-2026-2144 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-44018 · Vendor Advisory
• https://github.com/docling-project/docling · Note
• https://github.com/docling-project/docling/releases/tag/v2.91.0 · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/docling/PYSEC-2026-2144.yaml · Note
• https://t.me/cveNotify/178022 · Telegram Post
• https://t.me/CVEtracker/58092 · Telegram Post