GitHub Advisoryadvisory · PyPI

GHSA-j5xp-7m2f-49jv Docling Core: Insufficient validation of image reference URIs

HIGH Published 2026-06-03 Modified 2026-06-03 Official page ↗
Aliases
CVE-2026-44019
Ecosystem
PyPI
Packages
docling-core
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H
Weaknesses
CWE-400, CWE-73
Reviewed
2026-06-03

Affected packages

• PyPI docling-core: >= 2.5.0, < 2.74.1 → fixed in 2.74.1

Description

Impact In versions `>= 2.5.0, = 2.74.1` Workarounds If upgrading is not immediately possible: • reject `file:` and `data:` image references from untrusted input • allow only approved local or remote image sources • apply input size and memory limits to processing workers References • Fix release: `v2.74.1`

Related

Alias · CVE (1)

  • CVE-2026-44019 Docling Core defines core data types and transformations for the document processing application Docling. vulnerability

Weakness · CWE (2)

  • CWE-400 Uncontrolled Resource Consumption weakness
  • CWE-73 External Control of File Name or Path weakness

References