CVE-2026-44018 Overview
CVE-2026-44018 affects Docling, an open-source library that parses diverse document formats and integrates with generative AI pipelines. The vulnerability exists in versions 2.45.0 through 2.90.x and stems from missing security controls in the METS-GBS backend's XML parser and document format detection logic. An attacker who supplies a crafted METS-GBS archive can read sensitive local files, exhaust system resources, or crash the application. The maintainers fixed the issue in version 2.91.0. The weakness is categorized as [CWE-409] Improper Handling of Highly Compressed Data.
Critical Impact
Processing a malicious METS-GBS document can expose local files or trigger a denial of service on hosts running vulnerable Docling installations.
Affected Products
- Docling 2.45.0 through 2.90.x (Python package)
- Applications and AI pipelines embedding vulnerable Docling versions
- Automated document ingestion services using the METS-GBS backend
Discovery Timeline
- 2026-06-26 - CVE-2026-44018 published to NVD
- 2026-06-27 - Last updated in NVD database
Technical Details for CVE-2026-44018
Vulnerability Analysis
Docling's METS-GBS backend processes Metadata Encoding and Transmission Standard archives used by Google Books Search (GBS). The backend parses XML content and detects input document formats without applying hardening against untrusted input. An attacker who controls the input archive can trigger XML External Entity (XXE) style behavior, resource exhaustion from expanded or nested structures, and unhandled parsing errors that crash the process.
Exploitation requires a local attack vector and user interaction, meaning a victim must open or ingest the malicious document. The impact combines high confidentiality loss through file disclosure with high availability loss through resource exhaustion. Integrity is not affected because the parser does not modify system state during processing.
Root Cause
The root cause is missing security configuration on the XML parser used by the METS-GBS backend. Standard Python XML libraries expand external entities and process deeply nested structures by default unless explicitly restricted. The format detection routine also lacks bounds and validation checks, allowing malformed inputs to trigger unhandled exceptions or excessive resource consumption. See the GitHub Security Advisory GHSA-r3xg-rg9j-67fv for details.
Attack Vector
An attacker crafts a METS-GBS archive containing malicious XML payloads. When a user or automated pipeline submits the document to Docling for processing, the vulnerable backend parses the XML without restrictions. External entity references can read arbitrary files readable by the Docling process, while recursive entity expansion or oversized structures can exhaust memory and CPU. Because Docling is often deployed inside document ingestion services and retrieval-augmented generation pipelines, a single malicious upload can affect downstream AI workloads.
No verified public proof-of-concept exploit is available. Refer to the GitHub Release v2.91.0 notes for the fix description.
Detection Methods for CVE-2026-44018
Indicators of Compromise
- METS-GBS archives containing XML DOCTYPE declarations or external entity references submitted to Docling endpoints
- Docling worker processes exhibiting sustained high CPU or memory usage during document parsing
- Unexpected file read attempts by the Python process hosting Docling against paths such as /etc/passwd or application secrets
- Application crashes or unhandled exceptions originating from the METS-GBS backend module
Detection Strategies
- Inventory Python environments and identify Docling installations with versions between 2.45.0 and 2.90.x
- Inspect ingestion logs for METS-GBS document types and correlate with anomalous parsing durations
- Monitor for process crashes or OutOfMemory events in services embedding Docling
- Alert on outbound network connections initiated by Docling workers, which may indicate blind XXE
Monitoring Recommendations
- Enable file access auditing on hosts running Docling to capture reads outside expected document directories
- Track resource consumption metrics per document parse operation and threshold on outliers
- Forward Docling application logs to a centralized platform for retention and correlation with document upload events
How to Mitigate CVE-2026-44018
Immediate Actions Required
- Upgrade Docling to version 2.91.0 or later across all Python environments
- Audit AI and document processing pipelines for embedded Docling dependencies, including transitive installs
- Restrict document ingestion sources to trusted users and authenticated systems until patching is complete
- Run Docling workers under least-privilege service accounts with restricted filesystem access
Patch Information
The vulnerability is fixed in Docling 2.91.0. Upgrade using pip install --upgrade docling and pin the minimum version in dependency manifests. Review the GitHub Release v2.91.0 changelog and the GitHub Security Advisory GHSA-r3xg-rg9j-67fv for full remediation details.
Workarounds
- Disable or reject METS-GBS input formats at the application layer until the upgrade is deployed
- Sandbox Docling processing in containers with read-only filesystems and no outbound network egress
- Enforce file size and parse time limits on document ingestion queues to reduce denial-of-service exposure
# Configuration example
pip install --upgrade 'docling>=2.91.0'
pip show docling | grep -i version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
