CVE-2026-44019 | Docling Core defines core data types and transformations for… | CVSS 8.1 HIGH

Description

Docling Core defines core data types and transformations for the document processing application Docling. In versions 2.5.0 and above, prior to 2.74.1, docling-core could allow local file:// image references and accepted inline data: content without a decoded-size limit. In applications that accept untrusted image references, this may allow access to local files readable by the process or excessive memory use from large inline payloads. This issue has been fixed in version 2.74.1.

Metadata

CVE ID: CVE-2026-44019
State: PUBLISHED
Assigner: GitHub_M
Reserved: 2026-05-04 21:24 UTC
Published: 2026-07-16 20:50 UTC
Last updated: 2026-07-16 20:50 UTC
Primary CWE: CWE-73
CWE-73: External Control of File Name or Path
Vendor / Product: docling-project / docling-core
Sources: cve.org · NVD

Severity & Metrics

8.1 HIGH CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H

Affected products (1)

Vendor	Product	Platform	Versions
docling-project	docling-core	—	>= 2.5.0, < 2.74.1

Weakness (CWE)

CWE	Source	Description
CWE-400	cna	CWE-400: Uncontrolled Resource Consumption
CWE-73	cna	CWE-73: External Control of File Name or Path

CVSS scores (1)

Score	Severity	Version	Source	Vector
8.1	HIGH	3.1	cna	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H

References (2)

https://github.com/docling-project/docling-core/security/advisories/GHSA-j5xp-7m2f-49jv https://github.com/docling-project/docling-core/security/advisories/GHSA-j5xp-7m2f-49jv
https://github.com/docling-project/docling-core/releases/tag/v2.74.1 https://github.com/docling-project/docling-core/releases/tag/v2.74.1