CVE-2026-44018: Docling METS-GBS XML Parsing Vulnerability (v2.45-2.90)

Technical summary

The vulnerability stems from insufficient input validation in the METS-GBS backend's XML parser (CWE-611: Improper Restriction of XML External Entity Reference) and weak document format detection logic (CWE-409: Improper Handling of Highly Compressed Data, CWE-776: Improper Restriction of Recursive Entity References in DTDs). When Docling processes a specially crafted METS-GBS archive, the parser may resolve external entities, process maliciously nested structures, or fail to bound resource consumption. This can lead to information disclosure through local file reads, denial of service through resource exhaustion, or application crashes.

Business impact

For organizations using Docling in document processing pipelines—particularly those handling user-uploaded files or documents from external sources—this vulnerability creates both availability and confidentiality risks. An attacker with the ability to supply documents could disrupt service availability or, in multi-tenant or shared-system environments, potentially access configuration files or temporary data. The impact is bounded by file system permissions and the application's execution context, but in typical deployment scenarios, sensitive files within the application's read scope could be exposed.

Affected systems

Docling versions 2.45.0 through 2.90.x are affected. Version 2.91.0 and later contain the fix. Any application or service that embeds Docling and processes METS-GBS documents—especially those accepting user-supplied files—is at risk. Assess your inventory for Docling usage across document processing, data ingestion, and AI-powered analysis workflows.

Exploitability

Exploitation requires user interaction: a user must open or process a malicious METS-GBS file. No network attack vector or elevated privileges are needed. The attacker surface is limited to scenarios where documents can be supplied externally—file uploads, email attachments processed by automation, or shared document repositories. Docling is not a widely deployed end-user application, so risk is concentrated in organizations that have integrated it into their infrastructure.

Remediation

Upgrade Docling to version 2.91.0 or later. The fix hardens XML parsing by restricting external entity resolution and validates METS-GBS archive structure more strictly. For applications that cannot upgrade immediately, implement input validation to reject or sandbox untrusted METS-GBS files, and restrict Docling's file system access via OS-level controls (chroot, containers, least-privilege accounts).

Patch guidance

Docling 2.91.0 addresses the vulnerability. Coordinate the upgrade with your application release cycle, as Docling is typically a dependency rather than a standalone service. Verify compatibility with your current Docling integration before deploying to production. Check the vendor advisory for any breaking changes or migration notes. If your application vendor provides Docling as part of a bundled package, ensure they have released a patched version of their product.

Detection guidance

Monitor logs for unusual METS-GBS file processing patterns, such as exceptions during XML parsing, excessive memory consumption during document processing, or unexpected file access from Docling processes. Network-based detection is limited since this is a local file parsing issue. Endpoint detection should focus on anomalous behavior from applications using Docling when processing untrusted documents—e.g., unusual system calls, resource spikes, or failed file access attempts.

Why prioritize this

This vulnerability merits prompt but not emergency attention. The CVSS score of 5.5 (Medium) reflects the requirement for user interaction and limited attack surface. However, if your organization accepts user-supplied documents or integrates Docling into automated pipelines, prioritize patching to close the availability and confidentiality window. Organizations processing only internal, trusted documents face lower risk.

Risk score, explained

CVSS 5.5 reflects: (1) local attack vector—the file must be processed on the victim's system; (2) no privileges required; (3) user interaction needed; (4) high availability impact (resource exhaustion, crashes) but no confidentiality or integrity impact noted in the base vector. Note that the CWE mappings suggest information disclosure is possible (file reads), which may not be fully reflected in the base CVSS. Assess confidentiality risk in your context based on what files Docling can access.

Frequently asked questions