CVE-2026-105747

Docling: METS-GBS archive member limit enforced after full member enumeration (memory exhaustion during format detection)

State: Published
Severity: 4.3 Medium
Published: Oct 5, 2026
Updated: Oct 6, 2026
Reserved: Oct 5, 2026

Read the record on cve.org

Description

Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.45.0 until 2.131.0, METS-GBS format detection in docling/datamodel/document.py and the backend in docling/backend/mets_gbs_backend.py call tarfile.TarFile.getmembers() before enforcing the max_member_count limit, causing the full archive member list to be allocated before the limit can stop processing. A small gzip-compressed tar archive with a very large number of empty members can therefore consume memory proportional to the declared member count, including during format detection before the allowed_formats restriction is applied. This issue is a residual weakness in the member-count protection added for CVE-2026-44018. This issue is fixed in 2.131.0.

Scores

CVSS	Score	Vector	Source
3.1	4.3 Medium	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L	GitHub_M

Weaknesses

CWE-409 Improper Handling of Highly Compressed Data (Data Amplification)
CWE-770 Allocation of Resources Without Limits or Throttling

Affected Products

Product	Versions
doclingdocling-project	>= 2.45.0, < 2.131.0Affected
docling-slimdocling-project	>= 2.45.0, < 2.131.0Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.