CVE-2026-105747: CWE-409: Improper Handling of Highly Compressed Data (Data Amplification) in docling-project docling
Description
CVE-2026-105747 is a medium severity vulnerability in docling-project's docling software affecting versions from 2.45.0 up to but not including 2.131.0. The issue involves improper handling of highly compressed tar archives during METS-GBS format detection, where the full list of archive members is allocated in memory before enforcing a member count limit. This can lead to excessive memory consumption proportional to the declared member count, potentially causing denial of service. The vulnerability is fixed in version 2.131.0.
CVSS v3.1
Score 4.3medium
Affected software
docling-project
docling
docling-project
docling-slim
pkg:github/docling-project/doclingRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Docling versions >=2.45.0 and <2.131.0 have a vulnerability in the METS-GBS format detection code where tarfile.TarFile.getmembers() is called before enforcing the max_member_count limit. This causes the entire archive member list to be loaded into memory before the limit can prevent processing, allowing a crafted small gzip-compressed tar archive with many empty members to consume excessive memory. This is a residual weakness following a previous fix (CVE-2026-44018) and is addressed in version 2.131.0.
Potential Impact
An attacker can supply a specially crafted compressed tar archive with a large number of empty members that triggers excessive memory allocation during format detection. This can lead to denial of service due to resource exhaustion. There is no impact on confidentiality or integrity, and no known exploits in the wild have been reported.
Mitigation Recommendations
Upgrade docling to version 2.131.0 or later where this issue is fixed. No other mitigations are specified or required.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-10-05T19:11:07.947Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6ac41b4d2cdf04f6563d8ecf
Added to database: 10/05/2026, 21:49:01 UTC
Last enriched: 10/05/2026, 22:03:29 UTC
Last updated: 10/05/2026, 22:08:16 UTC
Views: 3
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.