CVE-2026-31247 | BDVDB-2026-332049 Detail

Description#

Docling's JATS XML backend is vulnerable to XML Entity Expansion (XXE) attacks thru 2.61.0. The backend uses etree.parse() to parse XML files without disabling entity resolution. An attacker can craft a malicious XML file containing a nested entity expansion payload (XML Bomb). When processed by Docling, the exponential expansion of entities leads to excessive resource consumption, resulting in a denial of service (DoS) condition on the system running the Docling parser.

Impact#

Weaknesses#

References#

Exploit#

History#

1. Version 12026-05-11Record published in the CVE List.
2. Version 22026-05-12Most recent update recorded in the CVE List.