CVE-2026-105743

Katalog CVE

CVSS 5.8 · Medium EPSS 0,19%

Kerentanan Time-of-check Time-of-use (TOCTOU) Race Condition pada docling. Skor CVSS 3.1 5.8 (Medium) menurut NVD.

Deskripsi (NVD)

Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.91.0 until 2.132.0, validate_url_safety in docling/backend/utils/image_resource_loader.py validates a hostname with a single IPv4 lookup and then allows the HTTP client to resolve and parse the original URL again, permitting DNS rebinding, mixed public and internal address records, and backslash authority parser disagreement to reach internal services. HTMLBackendOptions(render_page=True) also allows HTTP and HTTPS browser requests without validating their resolved destination. Exploitation requires remote fetching to be enabled, and response content is exposed only when it is decoded as an image or passively rendered in a page screenshot. This issue is fixed in 2.132.0.

Rincian

Terbit di NVD

5 Oktober 2026

Terakhir diubah

8 Oktober 2026

Status NVD

Analyzed

CVSS 3.1

5.8 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition
CWE-918: Server-Side Request Forgery (SSRF)

EPSS (30 hari)

0,19% peluang dieksploitasi; lebih tinggi dari 8,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/docling-project/docling/security/advisories/GHSA-pc36-qwjq-x68c patch · advisory vendor
• https://github.com/docling-project/docling/commit/5e469137f275ffc443306a30d12a3a45bceb80fb patch
• https://github.com/docling-project/docling/pull/4420 issue tracking · patch
• https://github.com/docling-project/docling/releases/tag/v2.132.0 release notes