CVE-2026-105743 in docling
Summary
by MITRE • 10/06/2026
Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.91.0 until 2.132.0, validate_url_safety in docling/backend/utils/image_resource_loader.py validates a hostname with a single IPv4 lookup and then allows the HTTP client to resolve and parse the original URL again, permitting DNS rebinding, mixed public and internal address records, and backslash authority parser disagreement to reach internal services. HTMLBackendOptions(render_page=True) also allows HTTP and HTTPS browser requests without validating their resolved destination. Exploitation requires remote fetching to be enabled, and response content is exposed only when it is decoded as an image or passively rendered in a page screenshot. This issue is fixed in 2.132.0.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/06/2026
The vulnerability identified within the Docling document processing library stems from insufficient validation of network resources during the parsing and rendering phases, specifically affecting versions ranging from 2.91.0 to 2.132.0. This security flaw allows for DNS rebinding attacks, where an attacker can manipulate Domain Name System responses to bypass access controls that rely on hostname verification. The core technical failure lies in the validate_url_safety function located within the image resource loader utility module. During execution, this function performs a single IPv4 lookup of the target hostname and subsequently marks it as safe based solely on that initial resolution. However, after validation passes, the underlying HTTP client is permitted to resolve and parse the original URL again before making the actual network request. This temporal gap between validation and execution creates an opportunity for DNS rebinding, where the IP address associated with a trusted domain can change dynamically during the connection establishment phase, effectively redirecting traffic from a public internet resource to an internal or private network service that was not originally intended to be accessed by the application.
Beyond the DNS rebinding issue, the vulnerability extends to mixed record handling and parser inconsistencies regarding authority components in URLs. The system fails to adequately distinguish between public-facing addresses and internal address records, allowing requests destined for local infrastructure such as cloud metadata services or internal APIs to proceed without restriction. Additionally, discrepancies in how backslashes are interpreted within URL authorities can be exploited to bypass validation logic that may not account for these edge cases consistently across different parsing libraries or versions. These flaws collectively undermine the integrity of network boundary enforcement mechanisms typically employed by document processing tools to prevent server-side request forgery and unauthorized data exfiltration from internal environments.
A significant aspect of this vulnerability involves the HTML backend options, particularly when the render_page parameter is set to true. In this configuration, the application allows HTTP and HTTPS browser requests without validating their resolved destinations against a whitelist or blacklist of allowed hosts. This lack of destination validation means that any URL provided in an input document can be fetched by the underlying headless browser component. The exploitation vector requires remote fetching capabilities to be enabled within the Docling environment. While the impact is somewhat constrained because response content is only exposed if it is decoded as an image or passively rendered in a page screenshot, this limitation does not eliminate the risk entirely. Attackers can leverage these rendering pathways to perform port scanning of internal networks, detect active services on private IP ranges, and potentially extract sensitive information embedded within images generated from internal web pages that contain authentication tokens, configuration details, or proprietary data.
From a classification perspective, this vulnerability aligns with CWE-918, which addresses Server-Side Request Forgery (SSRF) flaws where the web server makes requests to user-supplied URLs without proper validation of the destination address. It also relates closely to CWE-643, concerning improper mitigation for XPATH Injection or similar injection-based attacks if input parsing is involved, but more accurately fits CWE-20 regarding Improper Input Validation in the context of URL processing. In terms of offensive security frameworks, this behavior maps directly to MITRE ATT&CK technique T1571, which covers Non-Standard Port Usage and potentially T1498 Network Denial of Service if used for scanning purposes, but most critically it represents a classic SSRF pattern often associated with reconnaissance activities in lateral movement phases. The ability to resolve internal addresses via DNS rebinding is a sophisticated technique that bypasses naive hostname checks commonly found in legacy or poorly implemented security controls.
To mitigate this vulnerability, organizations must upgrade immediately to version 2.132.0 where the issue has been resolved through enhanced validation logic and stricter enforcement of network boundaries. For environments unable to patch immediately, it is critical to disable remote fetching capabilities entirely if they are not strictly required for document processing workflows. If remote content rendering is necessary, administrators should implement a robust allowlist mechanism that restricts access to only known and trusted external domains. Furthermore, deploying network-level controls such as egress filtering can help prevent outbound connections from reaching internal IP ranges or cloud metadata endpoints. Security teams should also audit their use of the HTMLBackendOptions configuration to ensure that render_page is not enabled in untrusted input scenarios. Regular security assessments focusing on SSRF vectors and DNS rebinding resilience are recommended for any system integrating third-party document processing libraries with network access capabilities.