Vulnerability · Published Jul 16, 2026 · Assigned by GitHub_M
CVE-2026-44019Docling Core has insufficient validation of image reference URIs
High 8.1
In plain English
A high-severity uncontrolled resource consumption in docling-core from docling-project. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 36% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Docling Core defines core data types and transformations for the document processing application Docling. In versions 2.5.0 and above, prior to 2.74.1, docling-core could allow local file:// image references and accepted inline data: content without a decoded-size limit. In applications that accept untrusted image references, this may allow access to local files readable by the process or excessive memory use from large inline payloads. This issue has been fixed in version 2.74.1.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| PyPI | docling-core | 2.74.1 | GHSA-j5xp-7m2f-49jv |
| PyPI | docling-core | 2.74.1 | PYSEC-2026-2456 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| docling-project | docling-core | >= 2.5.0, < 2.74.1 |
Weakness: CWE-73, CWE-400 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H