CVE-2026-44020: XXE Vulnerability in Docling USPTO Patent Parser

Technical summary

The vulnerability stems from unsafe use of xml.sax.parseString() in Docling's USPTO patent XML parsers (ICE v4.x, Grant v2.5, and Application v1.x formats) without XXE protection. By crafting XML with DOCTYPE declarations containing external entity references, an attacker can trigger entity resolution that reads local files (file:// URIs), initiates outbound connections to attacker-controlled or internal systems (SSRF), or invokes billion-laughs style entity expansion for denial of service. The attack requires the ability to provide input XML to the parser—typically through document upload, API submission, or data pipeline ingestion. Docling's integration with generative AI workflows may amplify exposure if document processing is part of an automated LLM ingestion pipeline.

Business impact

Organizations using Docling to process USPTO patent documents—common in legal tech, patent research, and regulatory compliance workflows—face data exfiltration risk if server filesystems contain credentials, API keys, or proprietary documents. SSRF attacks could allow lateral movement to internal services, databases, or cloud metadata endpoints. Denial-of-service via entity expansion could disrupt document processing pipelines, affecting time-sensitive patent filing, prior art searches, or regulatory analysis. The impact is heightened for multi-tenant SaaS offerings where one compromised document could affect other customers.

Affected systems

Docling versions 2.13.0 through 2.74.0 are affected. The vulnerability specifically impacts the three USPTO patent format parsers: ICE (v4.x), Grant (v2.5), and Application (v1.x). Any deployment ingesting USPTO patent XML files through these parsers is at risk. Downstream consumers of Docling—including document management systems, LLM preprocessing pipelines, and patent analysis tools—inherit the vulnerability if they use an affected version without additional input validation.

Exploitability

Exploitability is straightforward: an attacker needs network access to supply malicious XML to the parser (no authentication required) and standard XXE attack payloads are well-documented and easily adapted. The CVSS score of 7.5 (HIGH, AV:N/AC:L/PR:N/UI:N) reflects low attack complexity and no user interaction. However, practical exploitation depends on whether Docling accepts external XML input; if document processing is restricted to internal, pre-validated files, exposure is reduced. No evidence of public exploitation has been reported as of the advisory date.

Remediation

Upgrade Docling to version 2.74.0 or later immediately. This release includes XXE protections in the XML parser configuration. For organizations unable to upgrade immediately, restrict Docling's file input to internal, pre-validated USPTO XML sources and disable external entity resolution at the application level if your XML parsing library supports it (e.g., via defusedxml or equivalent hardening). Do not process USPTO patent XML from untrusted sources until patched.

Patch guidance

Verify your Docling version using `pip show docling` or equivalent package manager query. If below 2.74.0, update via `pip install --upgrade docling==2.74.0` (or later). Test the upgrade in a staging environment with your existing USPTO patent XML workflows to ensure compatibility. Check Docling's release notes (available on the GitHub repository or official documentation) for any breaking changes between your current version and 2.74.0. If you're unable to upgrade, consider using a containerized, air-gapped instance of older Docling versions or temporarily pausing USPTO patent XML processing.

Detection guidance

Monitor Docling processes for unusual file access patterns (reading /etc/passwd, /proc/self/, configuration files) or outbound network connections initiated during XML parsing. Log XML parsing errors and entity resolution attempts. Use network-based detection to identify XXE payloads (DOCTYPE declarations with SYSTEM/PUBLIC keywords pointing to file://, http://, or gopher:// URIs) in inbound document traffic. Endpoint monitoring for file descriptor access during document processing can reveal exfiltration attempts. Review Docling dependency trees to confirm no transitive dependencies introduce older, vulnerable XML parsing libraries.

Why prioritize this

This vulnerability warrants HIGH priority due to its combination of remote exploitability, network-accessible attack surface, and potential for data exfiltration in organizations handling sensitive patent and regulatory data. While not yet on the KEV catalog, the ease of exploitation and applicability to document processing pipelines integrated with AI systems (a growing attack vector) make it a near-term risk. Organizations processing USPTO patents—especially in legal, IP management, or compliance functions—should treat this as urgent.

Risk score, explained

The CVSS 3.1 score of 7.5 reflects: (1) Network vector—attack is remote with no credentials; (2) Low attack complexity—XXE exploitation uses standard techniques; (3) No user interaction—malicious XML is parsed automatically; (4) Confidentiality impact is none in the CVSS scope, but CWE-611 XXE attacks typically enable file read (classified as information disclosure in practice); (5) Availability impact is high due to denial-of-service via entity expansion. The score appropriately captures the denial-of-service risk; real-world risk may be higher for organizations whose threat model includes file exfiltration.

Frequently asked questions