CVE-2026-44020: Docling USPTO Patent Parser XXE Flaw

CVE-2026-44020 Overview

CVE-2026-44020 is an XML External Entity (XXE) vulnerability in Docling, a document processing library that parses diverse formats and integrates with the generative AI ecosystem. The flaw affects versions 2.13.0 through 2.73.x and resides in the USPTO patent XML parser, which uses xml.sax.parseString() without protections against external entity expansion. Attackers can submit malicious USPTO patent XML files to trigger file disclosure, Server-Side Request Forgery (SSRF), or denial of service through entity expansion attacks. The vulnerability is fixed in version 2.74.0 and is tracked under [CWE-776].

Critical Impact

Remote attackers can craft malicious XML documents to read arbitrary files, perform SSRF, or exhaust server resources through Billion Laughs-style entity expansion.

Affected Products

• Docling versions 2.13.0 through 2.73.x (USPTO ICE v4.x parser)
• Docling versions 2.13.0 through 2.73.x (USPTO Grant v2.5 parser)
• Docling versions 2.13.0 through 2.73.x (USPTO Application v1.x parser)

Discovery Timeline

• 2026-06-24 - CVE-2026-44020 published to NVD
• 2026-06-24 - Last updated in NVD database

Technical Details for CVE-2026-44020

Vulnerability Analysis

Docling parses USPTO patent XML documents using Python's xml.sax.parseString() API. The parser is invoked with default settings that permit external entity resolution and unbounded entity expansion. Three parsers are affected: the ICE (v4.x) parser, the Grant v2.5 parser, and the Application v1.x parser. An attacker who supplies a crafted USPTO XML document to any of these parsers can declare external entities that the SAX parser will resolve at parse time. The result is read access to local files, outbound requests from the server to attacker-chosen URLs, or process disruption through recursive entity expansion. Although the CVSS impact metrics emphasize availability, the underlying XXE primitive also enables confidentiality and lateral movement consequences depending on parser configuration and runtime environment.

Root Cause

The parsers call xml.sax.parseString() without disabling external entity resolution or capping entity expansion. Python's SAX implementation does not disable these features by default, so any document containing a DOCTYPE declaration with external or recursive entity definitions is processed as-is. This pattern maps to [CWE-776], improper restriction of recursive entity references in DTDs.

Attack Vector

An attacker delivers a malicious USPTO patent XML file to a Docling-powered ingestion pipeline. The file declares external entities pointing to local files such as /etc/passwd, internal URLs reachable from the server, or nested entities designed for exponential expansion. When Docling parses the document, the SAX handler resolves the entities and either returns the contents through downstream processing, issues outbound requests, or consumes memory and CPU until the process fails. No authentication or user interaction is required when the parser is exposed through an automated document workflow.

Detection Methods for CVE-2026-44020

Indicators of Compromise

• Inbound XML documents containing <!DOCTYPE> declarations with SYSTEM or PUBLIC external entity references.
• Outbound network connections from Docling processing hosts to unexpected internal or external endpoints during document parsing.
• Docling worker processes exhibiting abnormal memory growth or CPU saturation while parsing patent XML.
• File read operations targeting sensitive paths such as /etc/passwd, /proc/self/environ, or cloud metadata endpoints originating from the Docling runtime.

Detection Strategies

• Inspect Docling input corpora for XML files containing ENTITY declarations, parameter entities, or nested entity expansion patterns characteristic of Billion Laughs attacks.
• Monitor Docling host egress traffic and alert on requests to link-local metadata services (169.254.169.254) and internal-only address ranges.
• Audit Docling version inventory across build artifacts, container images, and Python environments to identify installations below 2.74.0.

Monitoring Recommendations

• Log all XML parsing exceptions and entity resolution attempts emitted by the SAX layer.
• Track CPU, memory, and parse duration metrics per document to surface entity expansion denial-of-service attempts.
• Forward Docling application logs and host telemetry to a centralized analytics platform for correlation across pipelines.

How to Mitigate CVE-2026-44020

Immediate Actions Required

• Upgrade Docling to version 2.74.0 or later in all environments that ingest USPTO patent XML.
• Restrict the Docling processing service from initiating outbound network connections except to required dependencies.
• Validate and sandbox untrusted XML inputs before passing them to any document parsing routine.
• Apply resource limits (memory, CPU, parse timeouts) to Docling worker processes to contain entity expansion attempts.

Patch Information

The vulnerability is fixed in Docling 2.74.0. Refer to the GitHub Security Advisory GHSA-m88r-rg27-5xfg for full remediation details and commit references.

Workarounds

• If upgrading is not immediately feasible, pre-filter incoming XML to reject documents containing <!DOCTYPE> or <!ENTITY> declarations.
• Run Docling inside an isolated network segment with strict egress controls to neutralize SSRF and external entity retrieval.
• Execute parsing workers under non-privileged accounts with read access limited to the document working directory.

# Configuration example
pip install --upgrade 'docling>=2.74.0'