Description
Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.0.0 until 2.131.0, the HTML, JATS, OpenDocument spreadsheet, and BoxNote backends, including docling/backend/html_backend.py, docling/backend/jats_backend.py, and docling/backend/boxnote_backend.py, accept the rowspan and colspan attribute values without an upper bound and execute loops or allocate a table grid proportional to the declared span. A very small document can therefore cause sustained CPU use or multi-gigabyte memory allocation, and the document_timeout setting does not interrupt the single backend conversion call. Export through the TableData.grid property can further materialize the oversized grid. This issue is fixed in 2.131.0.
Published: 2026-10-05
Score: 6.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service via CPU and memory exhaustion
Action: Immediate Patch
AI Analysis

Impact

Docling’s HTML, JATS, ODS and BoxNote backends accept rowspan and colspan attributes without an upper bound. This behavior corresponds to CWE‑400 (Uncontrolled Resource Consumption), CWE‑789 (Out‑of‑bounds Memory Allocation), and CWE‑770 (Resource Allocation). A crafted table can cause the backend to loop or reserve a grid proportional to the declared span, producing sustained CPU usage or several gigabytes of memory allocation. The document_timeout setting does not interrupt the single backend conversion call, so the exploit results in a local denial‑of‑service for the process that performs the conversion.

Affected Systems

The affected products are docling‑project:docling and docling‑project:docling‑slim. All releases between 2.0.0 and 2.130.x are vulnerable; the fix was introduced in version 2.131.0.

Risk and Exploitability

The CVSS score of 6.5 indicates moderate severity, and the attack vector requires an attacker to supply a document to the conversion service. While EPSS data is unavailable and the issue is not listed in the CISA KEV catalog, the local denial of service caused by excessive CPU or memory consumption remains a tangible risk for systems that process untrusted documents with Docling.

Generated by OpenCVE AI on October 7, 2026 at 06:21 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade docling to version 2.131.0 or later, which adds bounds checking for table spans.
  • Enforce an explicit maximum for rowspan and colspan values (e.g., 65535) to mitigate CWE‑400, CWE‑789, and CWE‑770; reject or truncate oversized attributes before conversion.
  • Run conversion of untrusted documents in a sandboxed environment or disable the affected backends until the vulnerability is patched.

Generated by OpenCVE AI on October 7, 2026 at 06:21 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Github GHSA Github GHSA GHSA-cgc7-9qp3-86m3 Docling: Unbounded table rowspan/colspan in HTML, JATS, ODS and BoxNote backends causes CPU/memory exhaustion
History

Thu, 08 Oct 2026 03:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 07 Oct 2026 19:00:00 +0000

Type Values Removed Values Added
First Time appeared Docling
Docling docling
CPEs cpe:2.3:a:docling:docling:*:*:*:*:*:*:*:*
Vendors & Products Docling
Docling docling

Tue, 06 Oct 2026 21:00:00 +0000

Type Values Removed Values Added
First Time appeared Docling-project
Docling-project docling
Vendors & Products Docling-project
Docling-project docling

Tue, 06 Oct 2026 12:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-770
References
Metrics threat_severity

None

 threat_severity

Moderate

Mon, 05 Oct 2026 21:45:00 +0000

Type Values Removed Values Added
Description Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.0.0 until 2.131.0, the HTML, JATS, OpenDocument spreadsheet, and BoxNote backends, including docling/backend/html_backend.py, docling/backend/jats_backend.py, and docling/backend/boxnote_backend.py, accept the rowspan and colspan attribute values without an upper bound and execute loops or allocate a table grid proportional to the declared span. A very small document can therefore cause sustained CPU use or multi-gigabyte memory allocation, and the document_timeout setting does not interrupt the single backend conversion call. Export through the TableData.grid property can further materialize the oversized grid. This issue is fixed in 2.131.0.
Title Docling: Unbounded table rowspan/colspan in HTML, JATS, ODS and BoxNote backends causes CPU/memory exhaustion
Weaknesses CWE-400
CWE-789
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H'}

Subscriptions

Docling Docling
Docling-project Docling
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-10-08T02:29:09.184Z

Reserved: 2026-10-05T19:11:07.947Z

Link: CVE-2026-105749

cve-icon Vulnrichment

Updated: 2026-10-08T02:29:01.421Z

cve-icon NVD

Status : Modified

Published: 2026-10-05T22:16:57.943

Modified: 2026-10-08T03:16:35.093

Link: CVE-2026-105749

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-10-05T21:36:53Z

Links: CVE-2026-105749 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-10-07T06:30:13Z

Weaknesses
  • CWE-400

    Uncontrolled Resource Consumption

  • CWE-770

    Allocation of Resources Without Limits or Throttling

  • CWE-789

    Memory Allocation with Excessive Size Value