CVE-2026-105749

Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.0.0 until 2.131.0, the HTML, JATS, OpenDocument spreadsheet, and BoxNote backends, including docling/backend/htmlbackend.py, docling/backend/jatsbackend.py, and...

CVE-2026-105749

The Docling library (versions 2.0.0 through 2.131.0) is vulnerable to CPU and memory exhaustion via its HTML , JATS , OpenDocument spreadsheet , and BoxNote backends. The root cause is that these backends accept rowspan and colspan attribute values without an upper bound, triggering loops or memo...