Docling's METS GBS backend processes XML files stored inside .tar.gz archives by calling etree.fromstring() without disabling external entity resolution. An attacker can embed a malicious XML file containing a large number of nested entity definitions—an XML bomb—into the archive. When the backend parses the file, the XML parser expands the entities exponentially, consuming excessive CPU and memory until the system becomes unresponsive, thereby creating a denial of service condition.

All installations of Docling whose METS GBS backend version is 2.61.0 or earlier are affected. The vulnerability is tied to the XML processing routine in that specific version range and does not extend to later releases that have not been confirmed to be patched.

The CVSS score is 7.5, indicating high severity, and the EPSS score is <1%, suggesting a very low probability of exploitation in the wild. However, the attack vector is external; an adversary who can supply a .tar.gz archive to the backend can trigger the exploit. The vulnerability is not listed in the CISA KEV catalog, but the uncontrolled resource consumption presents a high‑impact denial of service risk if an attacker targets the system. Organizations should evaluate the exposure of their Docling deployment to uploaded archives and consider the potential for DoS.