CVE-2026-44018

Katalog CVE

CVSS 7.1 · High EPSS 0,16%

Kerentanan Improper Handling of Highly Compressed Data (Data Amplification) pada docling. Skor CVSS 3.1 7.1 (High) menurut NVD.

Deskripsi (NVD)

Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.45.0 until 2.91.0, the METS-GBS backend's XML parsing and the input document format detection lacked security controls. An attacker could craft malicious METS-GBS archives that, when processed, could read sensitive files, exhaust system resources, or cause application crashes. This vulnerability is fixed in 2.91.0.

Rincian

Terbit di NVD

26 Juni 2026

Terakhir diubah

27 Juni 2026

Status NVD

Analyzed

CVSS 3.1

7.1 (High), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-409: Improper Handling of Highly Compressed Data (Data Amplification)
CWE-611: Improper Restriction of XML External Entity Reference
CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')

EPSS (30 hari)

0,16% peluang dieksploitasi; lebih tinggi dari 4,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/docling-project/docling/security/advisories/GHSA-r3xg-rg9j-67fv patch · advisory vendor
• https://github.com/docling-project/docling/releases/tag/v2.91.0 release notes