Threats tagged 'ghsa-cgc7-9qp3-86m3'

CVE-2026-105749 is an uncontrolled resource consumption vulnerability in the docling-project's docling software. Versions from 2.0.0 up to but not including 2.131.0 allow HTML, JATS, OpenDocument spreadsheet, and BoxNote backends to accept rowspan and colspan attribute values without upper bounds. This can cause excessive CPU usage or multi-gigabyte memory allocation when processing small documents. The document_timeout setting does not interrupt the backend conversion call, exacerbating the impact. The issue is fixed in version 2.131.0.