CVE-2026-44020

Docling vulnerability CVE-2026-44020 affects the USPTO patent XML parsers (ICE v4.x, Grant v2.5, Application v1.x) and versions from 2.13.0 up to 2.74.0. The root cause is use of xml.sax.parseString() without protection against XML External Entity (XXE) attacks, enabling attackers to craft USPTO ...