PYSEC-2026-2456

Vulnerability from pysec - Published: 2026-07-13 15:46 - Updated: 2026-07-13 16:03
VLAI
Details

Impact

In versions >= 2.5.0, < 2.74.1, docling-core could allow local file:// image references and accepted inline data: content without a decoded-size limit.

In applications that accept untrusted image references, this may allow access to local files readable by the process or excessive memory use from large inline payloads.

Patches

Patched in docling-core 2.74.1. The fix blocks local file URIs by default and adds a size limit for decoded inline image data.

Users should upgrade to: - docling-core >= 2.74.1

Workarounds

If upgrading is not immediately possible: - reject file: and data: image references from untrusted input - allow only approved local or remote image sources - apply input size and memory limits to processing workers

References

Severity
8.1 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H
Impacted products
Name purl
docling-core pkg:pypi/docling-core
Aliases
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "docling-core",
        "purl": "pkg:pypi/docling-core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.5.0"
            },
            {
              "fixed": "2.74.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.10.0",
        "2.11.0",
        "2.12.0",
        "2.12.1",
        "2.13.0",
        "2.13.1",
        "2.14.0",
        "2.15.0",
        "2.15.1",
        "2.16.0",
        "2.16.1",
        "2.17.0",
        "2.17.1",
        "2.17.2",
        "2.18.0",
        "2.18.1",
        "2.19.0",
        "2.19.1",
        "2.20.0",
        "2.21.0",
        "2.21.1",
        "2.21.2",
        "2.22.0",
        "2.23.0",
        "2.23.1",
        "2.23.2",
        "2.23.3",
        "2.24.0",
        "2.24.1",
        "2.25.0",
        "2.26.0",
        "2.26.1",
        "2.26.2",
        "2.26.3",
        "2.26.4",
        "2.27.0",
        "2.28.0",
        "2.28.1",
        "2.29.0",
        "2.30.0",
        "2.30.1",
        "2.31.0",
        "2.31.1",
        "2.31.2",
        "2.32.0",
        "2.33.0",
        "2.33.1",
        "2.34.0",
        "2.34.1",
        "2.34.2",
        "2.35.0",
        "2.36.0",
        "2.37.0",
        "2.38.0",
        "2.38.1",
        "2.38.2",
        "2.39.0",
        "2.40.0",
        "2.41.0",
        "2.42.0",
        "2.43.0",
        "2.43.1",
        "2.44.0",
        "2.44.1",
        "2.44.2",
        "2.45.0",
        "2.46.0",
        "2.47.0",
        "2.48.0",
        "2.48.1",
        "2.48.2",
        "2.48.3",
        "2.48.4",
        "2.49.0",
        "2.5.0",
        "2.5.1",
        "2.50.0",
        "2.50.1",
        "2.51.0",
        "2.51.1",
        "2.52.0",
        "2.53.0",
        "2.54.0",
        "2.54.1",
        "2.55.0",
        "2.56.0",
        "2.57.0",
        "2.58.0",
        "2.58.1",
        "2.59.0",
        "2.6.0",
        "2.6.1",
        "2.60.0",
        "2.60.1",
        "2.60.2",
        "2.61.0",
        "2.62.0",
        "2.63.0",
        "2.64.0",
        "2.65.0",
        "2.65.1",
        "2.65.2",
        "2.66.0",
        "2.67.0",
        "2.67.1",
        "2.68.0",
        "2.69.0",
        "2.7.0",
        "2.7.1",
        "2.70.0",
        "2.70.1",
        "2.70.2",
        "2.71.0",
        "2.72.0",
        "2.73.0",
        "2.74.0",
        "2.8.0",
        "2.9.0"
      ]
    }
  ],
  "aliases": [
    "CVE-2026-44019",
    "GHSA-j5xp-7m2f-49jv"
  ],
  "details": "### Impact\nIn versions `\u003e= 2.5.0, \u003c 2.74.1`, `docling-core`  could allow local `file://` image references and accepted inline `data:` content without a decoded-size limit.\n\nIn applications that accept untrusted image references, this may allow access to local files readable by the process or excessive memory use from large inline payloads.\n\n### Patches\nPatched in `docling-core` `2.74.1`.\nThe fix blocks local file URIs by default and adds a size limit for decoded inline image data.\n\nUsers should upgrade to:\n- `docling-core` `\u003e= 2.74.1`\n\n### Workarounds\nIf upgrading is not immediately possible:\n- reject `file:` and `data:` image references from untrusted input\n- allow only approved local or remote image sources\n- apply input size and memory limits to processing workers\n\n### References\n- Fix release: [`v2.74.1`](https://github.com/docling-project/docling-core/releases/tag/v2.74.1)",
  "id": "PYSEC-2026-2456",
  "modified": "2026-07-13T16:03:55.733797Z",
  "published": "2026-07-13T15:46:14.500928Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/docling-project/docling-core/security/advisories/GHSA-j5xp-7m2f-49jv"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/docling-project/docling-core"
    },
    {
      "type": "WEB",
      "url": "https://github.com/docling-project/docling-core/releases/tag/v2.74.1"
    },
    {
      "type": "PACKAGE",
      "url": "https://pypi.org/project/docling-core"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/advisories/GHSA-j5xp-7m2f-49jv"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44019"
    }
  ],
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Docling Core: Insufficient validation of image reference URIs"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.