Read the docs
TI-2026-68358 Aliases CVE-2026-105747GHSA-3cr3-8m4c-fpxwGHSA-f4ch-vxwc-3p2m

Memory exhaustion in Docling METS-GBS tar archive handling

Priority LOW 20CWE-409Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · Low
Fix status
Partial Red Hat: 2 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-770.

Summary

Docling versions from 2.45.0 before 2.131.0 and docling-slim versions from 2.92.0 before 2.131.0 are affected. The METS-GBS backend lists all tar archive members before enforcing the member count limit, so a small gzip-compressed archive with a very large number of empty members can exhaust memory (CWE-770). An attacker only needs to get such an archive processed, including during format detection, and needs no privileges.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.45.0 until 2.131.0, METS-GBS format detection in docling/datamodel/document.py and the backend in docling/backend/mets_gbs_backend.py call tarfile.TarFile.getmembers() before enforcing the max_member_count limit, causing the full archive member list to be allocated before the limit can stop processing. A small gzip-compressed tar archive with a very large number of empty members can therefore consume memory proportional to the declared member count, including during format detection before the allowed_formats restriction is applied. This issue is a residual weakness in the member-count protection added for CVE-2026-44018. This issue is fixed in 2.131.0.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00299 22nd percentileScored 2026-11-07
Fix Partial docling (docling-project): 2.131.0docling-slim (docling-project): 2.131.0+2 more productsRed Hat: 2 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
docling-projectdocling2.45.0 to before 2.131.02.131.0Patch availableCNA
docling-projectdocling-slim2.45.0 to before 2.131.02.131.0Patch availableCNA
—docling (PyPI)2.45.0 to before 2.131.02.131.0Patch availableGHSA-3cr3-8m4c-fpxw
—docling-slim (PyPI)2.92.0 to before 2.131.02.131.0Patch availableGHSA-3cr3-8m4c-fpxw
  • docling Vendordocling-project Affected 2.45.0 to before 2.131.0 Fixed in 2.131.0 Patch available CNA
  • docling-slim Vendordocling-project Affected 2.45.0 to before 2.131.0 Fixed in 2.131.0 Patch available CNA
  • docling (PyPI) Vendor— Affected 2.45.0 to before 2.131.0 Fixed in 2.131.0 Patch available GHSA-3cr3-8m4c-fpxw
  • docling-slim (PyPI) Vendor— Affected 2.92.0 to before 2.131.0 Fixed in 2.131.0 Patch available GHSA-3cr3-8m4c-fpxw

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:docling:docling:*:*:*:*:*:*:*:*2.45.0 to before 2.131.0Vulnerabledocling-project
  • cpe:2.3:a:docling:docling:*:*:*:*:*:*:*:* Versions 2.45.0 to before 2.131.0 Vulnerable ·docling-project

Remediation

Upgrade docling and docling-slim to 2.131.0, which fixes this issue. Red Hat lists Lightspeed Core and Red Hat OpenShift AI (RHOAI) as affected with no fix available.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

  • Fix · CNA docling (docling-project) Fixed in 2.131.0
  • Fix · CNA docling-slim (docling-project) Fixed in 2.131.0
  • Fix · GHSA-3cr3-8m4c-fpxw docling (PyPI) Fixed in 2.131.0 Advisory →
  • Fix · GHSA-3cr3-8m4c-fpxw docling-slim (PyPI) Fixed in 2.131.0 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Lightspeed CoreAffectedNo fix yet: Fix deferred
Red Hat OpenShift AI (RHOAI)AffectedNo fix yet: Fix deferred

Timeline

  1. 2026-10-06 Threatist record created from CVE-2026-105747
  2. 2026-10-06 Alias added: GHSA-f4ch-vxwc-3p2m
  3. 2026-10-06 Affected versions changed · Red Hat
  4. 2026-10-06 CVSS score added · Red Hat
  5. 2026-10-06 CISA SSVC decision points changed
  6. 2026-10-06 Alias added: GHSA-3cr3-8m4c-fpxw
  7. 2026-10-06 Fix available: PyPI/[email protected], PyPI/[email protected] · GHSA-3cr3-8m4c-fpxw
  8. 2026-10-06 CVSS score added · GHSA-3cr3-8m4c-fpxw
  9. 2026-10-06 Weakness changed · GHSA-3cr3-8m4c-fpxw
  10. 2026-10-06 6 new references · GHSA-3cr3-8m4c-fpxw

References

Patch 3

Advisory 1

Other 2

  • TI-2026-68355 Docling Tectonic TikZ rendering enables arbitrary file read/write CVSS 3.1HIGH 8.8
  • TI-2026-68362 Arbitrary local file read in Docling OpenDocument backend CVSS 4.0MEDIUM 6.9
  • TI-2026-68360 Docling table span parsing causes CPU and memory exhaustion CVSS 3.1MEDIUM 6.5
  • TI-2026-68353 Docling sends configured HTTP headers to any remote image host CVSS 3.1MEDIUM 5.3
  • TI-2026-68359 Docling embeds local image files from crafted JSON documents CVSS 3.1MEDIUM 4.3
  • TI-2026-32061 Docling: Unsafe XML Entity Expansion in USPTO Patent Backend CVSS 3.1HIGH 7.5
See all 15 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences