Threats tagged 'ghsa-pc36-qwjq-x68c'

CVE-2026-105743 is a time-of-check to time-of-use (TOCTOU) race condition vulnerability in the docling-project's docling software. Versions from 2.91.0 up to but not including 2.132.0 are affected. The issue arises because the validate_url_safety function performs a single IPv4 lookup to validate a hostname but then allows the HTTP client to resolve and parse the original URL again, enabling DNS rebinding and mixed public/internal address records to bypass validation. Additionally, HTMLBackendOptions(render_page=True) permits HTTP and HTTPS requests without validating the resolved destination. Exploitation requires remote fetching to be enabled, and the response content is only exposed when decoded as an image or rendered passively in a page screenshot. The vulnerability is fixed in version 2.132.0.