CVE-2026-31247
highpriority · track · 0EPSS 0.004 · 29 %ileEUUSEPSS · scored 2026-10-27
Docling's JATS XML backend is vulnerable to XML Entity Expansion (XXE) attacks thru 2.61.0. The backend uses etree.parse() to parse XML files without disabling entity resolution. An attacker can craft a malicious XML file containing a nested entity expansion payload (XML Bomb). When processed by Docling, the exponential expansion of entities leads to excessive resource consumption, resulting in a denial of service (DoS) condition on the system running the Docling parser.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 6.9–7.5
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (2)
Products and version ranges known to be affected.
advisories (2)
Vendor and ecosystem advisories describing this.
- GHSA-cr42-rg2m-mq4qDocling's JATS XML backend is vulnerable to XML Entity Expansion (XXE) attacks2026-05-11ghsa · osvUS
Docling's JATS XML backend is vulnerable to XML Entity Expansion (XXE) attacks thru 2.61.0. The backend uses etree.parse() to parse XML files without disabling entity resolution. An attacker can craft a malicious XML file containing a nested entity expansion payload (XML Bomb). When processed by Docling, the exponential expansion of entities leads to excessive resource consumption, resulting in a denial of service (DoS) condition on the system running the Docling parser.
- PYSEC-2026-2455Docling's JATS XML backend is vulnerable to XML Entity Expansion (XXE) attacks2026-07-13vendor · osvUS
Docling's JATS XML backend is vulnerable to XML Entity Expansion (XXE) attacks thru 2.61.0. The backend uses etree.parse() to parse XML files without disabling entity resolution. An attacker can craft a malicious XML file containing a nested entity expansion payload (XML Bomb). When processed by Docling, the exponential expansion of entities leads to excessive resource consumption, resulting in a denial of service (DoS) condition on the system running the Docling parser.
also known as (6)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (7)
External citations — patches, advisories, analysis.
- https://github.com/docling-project/doclingcnnvd
- https://github.com/docling-project/docling/releasesPatchcnnvd
- https://www.notion.so/CVE-2026-31247-35d1e1393188818fa654c116c6a470bbcnnvd
- https://github.com/docling-project/doclingenisa_euvd
- https://www.notion.so/CVE-2026-31247-35d1e1393188818fa654c116c6a470bbenisa_euvd
- https://github.com/docling-project/doclingnvd
- https://www.notion.so/CVE-2026-31247-35d1e1393188818fa654c116c6a470bbnvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan