Log in Start free

Vulnerability · Published Oct 5, 2026 · Assigned by GitHub_M

CVE-2026-105749Docling: Unbounded table rowspan/colspan in HTML, JATS, ODS and BoxNote backends causes CPU/memory exhaustion

Medium 6.5

In plain English

A medium-severity uncontrolled resource consumption in docling from docling-project. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 22% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.5Medium
Exploit odds (30 days)0.3%top 78.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.0.0 until 2.131.0, the HTML, JATS, OpenDocument spreadsheet, and BoxNote backends, including docling/backend/html_backend.py, docling/backend/jats_backend.py, and docling/backend/boxnote_backend.py, accept the rowspan and colspan attribute values without an upper bound and execute loops or allocate a table grid proportional to the declared span. A very small document can therefore cause sustained CPU use or multi-gigabyte memory allocation, and the document_timeout setting does not interrupt the single backend conversion call. Export through the TableData.grid property can further materialize the oversized grid. This issue is fixed in 2.131.0.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
PyPIdocling2.131.0GHSA-cgc7-9qp3-86m3
PyPIdocling2.131.0PYSEC-2026-4195
PyPIdocling-slim2.131.0GHSA-cgc7-9qp3-86m3
PyPIdocling-slim2.131.0PYSEC-2026-4211

Affected products (as reported)

VendorProductVersions
docling-project docling >= 2.0.0, < 2.131.0
docling-project docling-slim >= 2.92.0, < 2.131.0

Weakness: CWE-400, CWE-789 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

References