https://vulnerability.circl.lu/sightings/feed 2026-10-09T18:07:04.104929+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/794493c4-a516-4cbf-aa8d-b7ddd288e7f3/export 2026-10-09T18:07:04.132941+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "794493c4-a516-4cbf-aa8d-b7ddd288e7f3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-105749", "type": "seen", "source": "https://gist.github.com/alon710/deb19c9c793066f6e4e6a40781829fd6", "content": "# CVE-2026-105749: CVE-2026-105749: Unbounded Table Attributes in Docling Backends Leads to Resource Exhaustion\n\n> **CVSS Score:** 6.5\n> **Published:** 2026-10-07\n> **Full Report:** https://cvereports.com/reports/CVE-2026-105749\n\n## Summary\nAn uncontrolled resource consumption vulnerability exists in the Docling document conversion library. Maliciously structured HTML, JATS, ODS, or BoxNote inputs containing table cells with excessively large 'rowspan' or 'colspan' attribute values trigger algorithmic complexity conditions. This allows unauthenticated remote attackers to initiate resource exhaustion states, crashing or hanging the target document processing pipeline while bypassing configured timeouts.\n\n## TL;DR\nDocling document parsers lack validation checks for table row and column spans, allowing tiny documents with extreme span values to exhaust host memory and CPU resources.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-400 (Uncontrolled Resource Consumption)\n- **Attack Vector**: Network / Remote Document Ingestion\n- **CVSS Severity**: 6.5 (Medium)\n- **EPSS Score**: 0.00256 (Percentile: 15.73%)\n- **Impact**: Complete Application Hang or Out-of-Memory Crash\n- **Exploit Status**: Proof-of-Concept Available\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Docling (Python Package)\n- Docling-Slim (Python Package)\n- Document Parsing Microservices utilizing Docling\n- **docling**: >= 2.0.0, < 2.131.0 (Fixed in: `2.131.0`)\n- **docling-slim**: >= 2.92.0, < 2.131.0 (Fixed in: `2.131.0`)\n\n## Mitigation\n\n- Upgrade Docling packages to version 2.131.0 or higher.\n- Implement proactive file scanning and regex filtering on upload endpoints to reject anomalous table span definitions.\n- Isolate parsing workloads within memory-limited sandbox environments (e.g., Docker containers with tight cgroups configuration).\n\n**Remediation Steps:**\n1. Run 'pip install --upgrade docling' to update your environment to version 2.131.0.\n2. Confirm that the sub-dependency 'docling-core' is updated to at least version 2.98.0.\n3. Deploy static analysis or payload validation on files prior to parsing to drop any documents containing unreasonably long strings within table attributes.\n\n## References\n\n- [Docling Advisory (GHSA-cgc7-9qp3-86m3)](https://github.com/docling-project/docling/security/advisories/GHSA-cgc7-9qp3-86m3)\n- [NVD CVE Record](https://nvd.nist.gov/vuln/detail/CVE-2026-105749)\n- [CVE.org Record](https://www.cve.org/CVERecord?id=CVE-2026-105749)\n- [Fix Commit](https://github.com/docling-project/docling/commit/c5b4429cc6500a344c13edeb22e67610c2159b09)\n- [Fix Pull Request](https://github.com/docling-project/docling/pull/4414)\n- [Docling Release Tag v2.131.0](https://github.com/docling-project/docling/releases/tag/v2.131.0)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-105749) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-10-08T09:30:28.000000Z"} 2026-10-08T09:30:28+00:00 https://vulnerability.circl.lu/sighting/ff4dd07b-24fe-4a27-ba8e-b04f269d5202/export 2026-10-09T18:07:04.135095+00:00 Joseph Lee https://cvepremium.circl.lu/user/syspect {"uuid": "ff4dd07b-24fe-4a27-ba8e-b04f269d5202", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-105749", "type": "published-proof-of-concept", "source": "https://github.com/docling-project/docling/security/advisories/GHSA-cgc7-9qp3-86m3", "content": "", "creation_timestamp": "2026-09-29T09:22:19.000000Z"} 2026-09-29T09:22:19+00:00