TI-2026-68353 Aliases CVE-2026-105742 GHSA-p3fw-7699-7926

Docling sends configured HTTP headers to any remote image host

MEDIUM 57CWE-201Published 2026-10-05 · Updated 2026-10-06

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Information disclosure
Confidentiality · integrity · availability: Low · None · None
Fix status: Partial Red Hat: 2 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-201.

Summary

Docling versions from 2.95.0 before 2.132.0 are affected, in both the docling and docling-slim packages. The HTML image resource loader forwards headers set in HTMLBackendOptions.headers to every remote image URL in a document, without limiting them to the document's origin, so cross-origin redirects expose the caller's credentials (CWE-522). A document author can obtain configured API keys and cookies when remote fetching and image fetching are enabled. A public exploit is linked in the references.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.95.0 until 2.132.0, the HTML image resource loader in docling/backend/utils/image_resource_loader.py forwards headers configured through the HTMLBackendOptions.headers setting to every remote image URL named by an untrusted document when enable_remote_fetch=True and fetch_images=True. The loader does not restrict those credentials to the source document's origin, allowing requests that carry custom headers such as API keys and cookies to follow cross-origin redirects and expose the caller's configured credentials to a document author. The default configuration is not affected because remote fetching and configured headers are required. This issue is fixed in 2.132.0.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00254 17th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Partial docling (docling-project): 2.132.0docling-slim (docling-project): 2.132.0+2 more productsRed Hat: 2 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
docling-project	docling	2.95.0 to before 2.132.0	2.132.0	Patch available	CNA
docling-project	docling-slim	2.95.0 to before 2.132.0	2.132.0	Patch available	CNA
—	docling (PyPI)	2.95.0 to before 2.132.0	2.132.0	Patch available	GHSA-p3fw-7699-7926
—	docling-slim (PyPI)	2.95.0 to before 2.132.0	2.132.0	Patch available	GHSA-p3fw-7699-7926

docling Vendordocling-project Affected 2.95.0 to before 2.132.0 Fixed in 2.132.0 Patch available CNA
docling-slim Vendordocling-project Affected 2.95.0 to before 2.132.0 Fixed in 2.132.0 Patch available CNA
docling (PyPI) Vendor— Affected 2.95.0 to before 2.132.0 Fixed in 2.132.0 Patch available GHSA-p3fw-7699-7926
docling-slim (PyPI) Vendor— Affected 2.95.0 to before 2.132.0 Fixed in 2.132.0 Patch available GHSA-p3fw-7699-7926

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:docling:docling::::::::	2.95.0 to before 2.132.0	Vulnerable	docling-project

cpe:2.3:a:docling:docling:*:*:*:*:*:*:*:* Versions 2.95.0 to before 2.132.0 Vulnerable ·docling-project

Remediation

Upgrade docling and docling-slim on PyPI to 2.132.0. Red Hat lists Lightspeed Core and Red Hat OpenShift AI (RHOAI) as affected without a fix and has no fix plan available for them.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Fix · CNA docling (docling-project) Fixed in 2.132.0
Fix · CNA docling-slim (docling-project) Fixed in 2.132.0
Fix · GHSA-p3fw-7699-7926 docling (PyPI) Fixed in 2.132.0 Advisory →
Fix · GHSA-p3fw-7699-7926 docling-slim (PyPI) Fixed in 2.132.0 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Low. Red Hat's page for this CVE →

Product	Status	Plan or fix
Lightspeed Core	Affected	No fix yet: Fix deferred
Red Hat OpenShift AI (RHOAI)	Affected	No fix yet: Fix deferred

Timeline

2026-10-06 Threatist record created from CVE-2026-105742
2026-10-06 Affected versions changed · Red Hat
2026-10-06 CVSS score added · Red Hat
2026-10-06 CISA SSVC decision points changed
2026-10-06 Priority changed: LOW → MEDIUM
2026-10-07 CVSS score added · NVD
2026-10-07 Alias added: GHSA-p3fw-7699-7926
2026-10-07 Fix available: PyPI/[email protected], PyPI/[email protected] · GHSA-p3fw-7699-7926
2026-10-07 CVSS score added · GHSA-p3fw-7699-7926
2026-10-07 Weakness changed · GHSA-p3fw-7699-7926
2026-10-07 6 new references · GHSA-p3fw-7699-7926

References

Exploit 1

https://github.com/docling-project/docling/security/advisories/GHSA-p3fw-7699-7926

Patch 2

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2026-105742

Other 2

TI-2026-68355 Docling Tectonic TikZ rendering enables arbitrary file read/write CVSS 3.1HIGH 8.8
TI-2026-68362 Arbitrary local file read in Docling OpenDocument backend CVSS 4.0MEDIUM 6.9
TI-2026-68360 Docling table span parsing causes CPU and memory exhaustion CVSS 3.1MEDIUM 6.5
TI-2026-68359 Docling embeds local image files from crafted JSON documents CVSS 3.1MEDIUM 4.3
TI-2026-32061 Docling: Unsafe XML Entity Expansion in USPTO Patent Backend CVSS 3.1HIGH 7.5
TI-2026-32058 Docling: Unsafe Zip Extraction in EasyOCR Model Download CVSS 3.1HIGH 7.5

See all 15 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences