CVE-2026-105749

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-105749", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-10-05T19:11:07.947Z", "datePublished": "2026-10-05T21:36:53.431Z", "dateUpdated": "2026-10-08T02:29:09.184Z"}, "containers": {"cna": {"title": "Docling: Unbounded table rowspan/colspan in HTML, JATS, ODS and BoxNote backends causes CPU/memory exhaustion", "problemTypes": [{"descriptions": [{"cweId": "CWE-400", "lang": "en", "description": "CWE-400: Uncontrolled Resource Consumption", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-789", "lang": "en", "description": "CWE-789: Memory Allocation with Excessive Size Value", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/docling-project/docling/security/advisories/GHSA-cgc7-9qp3-86m3", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/docling-project/docling/security/advisories/GHSA-cgc7-9qp3-86m3"}, {"name": "https://github.com/docling-project/docling/pull/4414", "tags": ["x_refsource_MISC"], "url": "https://github.com/docling-project/docling/pull/4414"}, {"name": "https://github.com/docling-project/docling/commit/c5b4429cc6500a344c13edeb22e67610c2159b09", "tags": ["x_refsource_MISC"], "url": "https://github.com/docling-project/docling/commit/c5b4429cc6500a344c13edeb22e67610c2159b09"}, {"name": "https://github.com/docling-project/docling/releases/tag/v2.131.0", "tags": ["x_refsource_MISC"], "url": "https://github.com/docling-project/docling/releases/tag/v2.131.0"}], "affected": [{"vendor": "docling-project", "product": "docling", "versions": [{"version": ">= 2.0.0, < 2.131.0", "status": "affected"}]}, {"vendor": "docling-project", "product": "docling-slim", "versions": [{"version": ">= 2.92.0, < 2.131.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-10-05T21:36:53.431Z"}, "descriptions": [{"lang": "en", "value": "Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.0.0 until 2.131.0, the HTML, JATS, OpenDocument spreadsheet, and BoxNote backends, including docling/backend/html_backend.py, docling/backend/jats_backend.py, and docling/backend/boxnote_backend.py, accept the rowspan and colspan attribute values without an upper bound and execute loops or allocate a table grid proportional to the declared span. A very small document can therefore cause sustained CPU use or multi-gigabyte memory allocation, and the document_timeout setting does not interrupt the single backend conversion call. Export through the TableData.grid property can further materialize the oversized grid. This issue is fixed in 2.131.0."}], "source": {"advisory": "GHSA-cgc7-9qp3-86m3", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/docling-project/docling/security/advisories/GHSA-cgc7-9qp3-86m3", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-10-08T02:28:41.797887Z", "id": "CVE-2026-105749", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-08T02:29:09.184Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-105749", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-08T02:28:41.797887Z"}}}], "references": [{"url": "https://github.com/docling-project/docling/security/advisories/GHSA-cgc7-9qp3-86m3", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-08T02:29:01.421Z"}}], "cna": {"title": "Docling: Unbounded table rowspan/colspan in HTML, JATS, ODS and BoxNote backends causes CPU/memory exhaustion", "source": {"advisory": "GHSA-cgc7-9qp3-86m3", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "docling-project", "product": "docling", "versions": [{"status": "affected", "version": ">= 2.0.0, < 2.131.0"}]}, {"vendor": "docling-project", "product": "docling-slim", "versions": [{"status": "affected", "version": ">= 2.92.0, < 2.131.0"}]}], "references": [{"url": "https://github.com/docling-project/docling/security/advisories/GHSA-cgc7-9qp3-86m3", "name": "https://github.com/docling-project/docling/security/advisories/GHSA-cgc7-9qp3-86m3", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/docling-project/docling/pull/4414", "name": "https://github.com/docling-project/docling/pull/4414", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/docling-project/docling/commit/c5b4429cc6500a344c13edeb22e67610c2159b09", "name": "https://github.com/docling-project/docling/commit/c5b4429cc6500a344c13edeb22e67610c2159b09", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/docling-project/docling/releases/tag/v2.131.0", "name": "https://github.com/docling-project/docling/releases/tag/v2.131.0", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.0.0 until 2.131.0, the HTML, JATS, OpenDocument spreadsheet, and BoxNote backends, including docling/backend/html_backend.py, docling/backend/jats_backend.py, and docling/backend/boxnote_backend.py, accept the rowspan and colspan attribute values without an upper bound and execute loops or allocate a table grid proportional to the declared span. A very small document can therefore cause sustained CPU use or multi-gigabyte memory allocation, and the document_timeout setting does not interrupt the single backend conversion call. Export through the TableData.grid property can further materialize the oversized grid. This issue is fixed in 2.131.0."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-400", "description": "CWE-400: Uncontrolled Resource Consumption"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-789", "description": "CWE-789: Memory Allocation with Excessive Size Value"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-10-05T21:36:53.431Z"}}}, "cveMetadata": {"cveId": "CVE-2026-105749", "state": "PUBLISHED", "dateUpdated": "2026-10-08T02:29:09.184Z", "dateReserved": "2026-10-05T19:11:07.947Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-10-05T21:36:53.431Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "docling", "vendor": "docling-project", "versions": [{"status": "affected", "version": ">= 2.0.0, < 2.131.0"}]}, {"product": "docling-slim", "vendor": "docling-project", "versions": [{"status": "affected", "version": ">= 2.92.0, < 2.131.0"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:docling:docling:*:*:*:*:*:*:*:*", "matchCriteriaId": "06283271-0264-48A3-B1C2-DCA994108840", "versionEndExcluding": "2.131.0", "versionStartIncluding": "2.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.0.0 until 2.131.0, the HTML, JATS, OpenDocument spreadsheet, and BoxNote backends, including docling/backend/html_backend.py, docling/backend/jats_backend.py, and docling/backend/boxnote_backend.py, accept the rowspan and colspan attribute values without an upper bound and execute loops or allocate a table grid proportional to the declared span. A very small document can therefore cause sustained CPU use or multi-gigabyte memory allocation, and the document_timeout setting does not interrupt the single backend conversion call. Export through the TableData.grid property can further materialize the oversized grid. This issue is fixed in 2.131.0."}], "id": "CVE-2026-105749", "lastModified": "2026-10-08T03:16:35.093", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-105749", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-10-08T02:28:41.797887Z", "version": "2.0.3"}}]}, "published": "2026-10-05T22:16:57.943", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/docling-project/docling/commit/c5b4429cc6500a344c13edeb22e67610c2159b09"}, {"source": "security-advisories@github.com", "tags": ["Issue Tracking", "Patch"], "url": "https://github.com/docling-project/docling/pull/4414"}, {"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/docling-project/docling/releases/tag/v2.131.0"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Patch", "Vendor Advisory"], "url": "https://github.com/docling-project/docling/security/advisories/GHSA-cgc7-9qp3-86m3"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Exploit", "Patch", "Vendor Advisory"], "url": "https://github.com/docling-project/docling/security/advisories/GHSA-cgc7-9qp3-86m3"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-400"}, {"lang": "en", "value": "CWE-789"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "docling: docling: Denial of Service via unbounded table span attributes", "id": "2546168", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2546168"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-770", "details": ["A flaw was found in docling. A remote attacker could cause a Denial of Service (DoS) by supplying a specially crafted document with excessively large table span attributes, such as rowspan or colspan. When processing the document, the parser attempts to allocate memory or execute processing loops proportional to the declared span, exhausting system resources and causing the application to become unresponsive."], "name": "CVE-2026-105749", "package_state": [{"cpe": "cpe:/a:redhat:lightspeed_core", "fix_state": "Fix deferred", "package_name": "lightspeed-core/rag-tool-cpu-rhel9", "product_name": "Lightspeed Core"}, {"cpe": "cpe:/a:redhat:lightspeed_core", "fix_state": "Fix deferred", "package_name": "lightspeed-core/rag-tool-cuda-12.9-rhel9", "product_name": "Lightspeed Core"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Fix deferred", "package_name": "rhai-early-access/docling-sdk-cuda-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Fix deferred", "package_name": "rhai-early-access/docling-serve-cuda-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Fix deferred", "package_name": "rhoai/odh-autorag-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Fix deferred", "package_name": "rhoai/odh-feature-server-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Fix deferred", "package_name": "rhoai/odh-ogx-core-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}], "public_date": "2026-10-05T21:36:53Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-105749\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-105749\nhttps://github.com/docling-project/docling/commit/c5b4429cc6500a344c13edeb22e67610c2159b09\nhttps://github.com/docling-project/docling/pull/4414\nhttps://github.com/docling-project/docling/releases/tag/v2.131.0\nhttps://github.com/docling-project/docling/security/advisories/GHSA-cgc7-9qp3-86m3"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[2.0.0,2.131.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "docling", "source": "cna", "vendor": "docling-project"}, "product": "docling", "vendor": "docling-project"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[2.92.0,2.131.0)"}}], "enrichment": {"confidence": 90.0, "confidence_source": "matching", "scores": [{"score": 90.0, "source": "matching"}]}, "original": {"product": "docling-slim", "source": "cna", "vendor": "docling-project"}, "product": "docling", "vendor": "docling-project"}], "created": "2026-10-05T23:00:19.041697+00:00", "updated": "2026-10-07T06:30:13.676259+00:00", "vendors": ["docling-project", "docling-project$PRODUCT$docling"]}