CVE-2026-44019

Received Received - Intake

Docling Core Local File Access and Memory Exhaustion Vulnerabilities

Publication date: 2026-07-16

Last updated on: 2026-07-16

Assigner: GitHub, Inc.

Description

Docling Core defines core data types and transformations for the document processing application Docling. In versions 2.5.0 and above, prior to 2.74.1, docling-core could allow local file:// image references and accepted inline data: content without a decoded-size limit. In applications that accept untrusted image references, this may allow access to local files readable by the process or excessive memory use from large inline payloads. This issue has been fixed in version 2.74.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-16

Last Modified

2026-07-16

Generated

2026-07-17

AI Q&A

2026-07-17

EPSS Evaluated

N/A

NVD

CVE-2026-44019

Affected Vendors & Products

Vendor	Product	Version / Range
docling	docling_core	to 2.74.1 (exc)
docling	docling_core	2.74.1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-400	The product does not properly control the allocation and maintenance of a limited resource.
CWE-73	The product allows user input to control or influence paths or file names that are used in filesystem operations.

Attack-Flow Graph

Executive Summary

Docling Core is a library for document processing. Versions 2.5.0 to 2.74.0 allow local file:// image references and inline data: content without size limits. This could let attackers access local files readable by the process or cause excessive memory use from large inline payloads.

Detection Guidance

To detect this vulnerability, check the version of docling-core installed on your system. If it is between 2.5.0 and 2.74.0, it is vulnerable. Run: pip show docling-core or pip list | grep docling-core to verify the version.

Impact Analysis

If you use an affected version in an application that processes untrusted documents, attackers could read local files on your system or trigger high memory usage, potentially leading to crashes or denial of service.

Compliance Impact

This vulnerability could impact compliance with GDPR and HIPAA by potentially allowing unauthorized access to local files through file:// references, which may expose sensitive data. Excessive memory use from large inline payloads could also lead to denial-of-service conditions, affecting system availability required by these regulations.

Mitigation Strategies

Upgrade Docling Core to version 2.74.1 or later to address the vulnerability. Review applications using docling-core to ensure they do not accept untrusted image references or inline data without size limits.

Hi! I’m here to help you understand CVE-2026-44019. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70