Read the docs
TI-2026-32449 Aliases CVE-2026-44520GHSA-fqph-j6v6-jvgx

Docling-Graph: SSRF via Missing Internal IP Validation in URLInputHandler

Priority LOW 25CWE-601Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Required
Attack complexity
Low
Impact type
Spoofing, Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-601, CWE-918 and the CVSS impact.

Summary

Docling-Graph turns documents into validated Pydantic objects, then builds a directed knowledge graph with explicit semantic relationships. Prior to 1.5.1, the URLInputHandler class in docling_graph/core/input/handlers.py makes HTTP requests to user-supplied URLs without validating whether the target resolves to a private, loopback, or link-local IP address. The URLValidator only checks for a valid scheme and non-empty netloc, performing no IP-level validation. Additionally, requests.head() was called with allow_redirects=True, allowing an attacker to redirect requests to internal endpoints via an intermediary URL. An attacker who can control the --source CLI argument or PipelineConfig.source API parameter can trigger Server-Side Request Forgery (SSRF). This vulnerability is fixed in 1.5.1.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00188 8th percentileScored 2026-11-07
Fix Fixed docling-graph (docling-project): 1.5.1docling-graph (PyPI): 1.5.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
docling-projectdocling-graphbefore 1.5.11.5.1Patch availableCNA
—docling-graph (PyPI)before 1.5.11.5.1Patch availableGHSA-fqph-j6v6-jvgx
  • docling-graph Vendordocling-project Affected before 1.5.1 Fixed in 1.5.1 Patch available CNA
  • docling-graph (PyPI) Vendor— Affected before 1.5.1 Fixed in 1.5.1 Patch available GHSA-fqph-j6v6-jvgx

Remediation

  • Fix · CNA docling-graph (docling-project) Fixed in 1.5.1
  • Fix · GHSA-fqph-j6v6-jvgx docling-graph (PyPI) Fixed in 1.5.1 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-44520
  2. 2026-10-03 Alias added: GHSA-fqph-j6v6-jvgx

References

Advisory 1

Other 3

  • TI-2026-68355 Docling Tectonic TikZ rendering enables arbitrary file read/write CVSS 3.1HIGH 8.8
  • TI-2026-68362 Arbitrary local file read in Docling OpenDocument backend CVSS 4.0MEDIUM 6.9
  • TI-2026-68360 Docling table span parsing causes CPU and memory exhaustion CVSS 3.1MEDIUM 6.5
  • TI-2026-68353 Docling sends configured HTTP headers to any remote image host CVSS 3.1MEDIUM 5.3
  • TI-2026-68359 Docling embeds local image files from crafted JSON documents CVSS 3.1MEDIUM 4.3
  • TI-2026-19347 Docling Core vulnerable to Remote Code Execution via unsafe PyYAML usage CVSS 3.1CRITICAL 9.8
See all 21 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences