id: PYSEC-2026-2455
published: "2026-07-13T15:15:44.598197Z"
modified: "2026-07-13T16:03:56.101215Z"
aliases:
- CVE-2026-31247
- GHSA-cr42-rg2m-mq4q
summary: Docling's JATS XML backend is vulnerable to XML Entity Expansion (XXE) attacks
details: Docling's JATS XML backend is vulnerable to XML Entity Expansion (XXE) attacks thru 2.61.0. The backend uses etree.parse() to parse XML files without disabling entity resolution. An attacker can craft a malicious XML file containing a nested entity expansion payload (XML Bomb). When processed by Docling, the exponential expansion of entities leads to excessive resource consumption, resulting in a denial of service (DoS) condition on the system running the Docling parser.
affected:
- package:
    name: docling
    ecosystem: PyPI
    purl: pkg:pypi/docling
  ranges:
  - type: ECOSYSTEM
    events:
    - introduced: "0"
    - last_affected: 2.61.0
  versions:
  - 0.1.0
  - 0.1.1
  - 0.1.2
  - 0.2.0
  - 0.3.0
  - 0.3.1
  - 0.4.0
  - 1.0.0
  - 1.0.1
  - 1.0.2
  - 1.1.0
  - 1.1.1
  - 1.1.2
  - 1.10.0
  - 1.11.0
  - 1.12.0
  - 1.12.1
  - 1.12.2
  - 1.13.0
  - 1.13.1
  - 1.14.0
  - 1.15.0
  - 1.16.0
  - 1.16.1
  - 1.17.0
  - 1.18.0
  - 1.19.0
  - 1.19.1
  - 1.2.0
  - 1.2.1
  - 1.20.0
  - 1.3.0
  - 1.4.0
  - 1.5.0
  - 1.6.0
  - 1.6.1
  - 1.6.2
  - 1.6.3
  - 1.7.0
  - 1.7.1
  - 1.8.0
  - 1.8.1
  - 1.8.2
  - 1.8.3
  - 1.8.4
  - 1.8.5
  - 1.9.0
  - 2.0.0
  - 2.1.0
  - 2.10.0
  - 2.11.0
  - 2.12.0
  - 2.13.0
  - 2.14.0
  - 2.15.0
  - 2.15.1
  - 2.16.0
  - 2.17.0
  - 2.18.0
  - 2.19.0
  - 2.2.0
  - 2.2.1
  - 2.20.0
  - 2.21.0
  - 2.22.0
  - 2.23.0
  - 2.23.1
  - 2.24.0
  - 2.25.0
  - 2.25.1
  - 2.25.2
  - 2.26.0
  - 2.27.0
  - 2.28.0
  - 2.28.1
  - 2.28.2
  - 2.28.3
  - 2.28.4
  - 2.29.0
  - 2.3.0
  - 2.3.1
  - 2.30.0
  - 2.31.0
  - 2.31.1
  - 2.31.2
  - 2.32.0
  - 2.33.0
  - 2.34.0
  - 2.35.0
  - 2.36.0
  - 2.36.1
  - 2.37.0
  - 2.38.0
  - 2.38.1
  - 2.39.0
  - 2.4.0
  - 2.4.1
  - 2.4.2
  - 2.40.0
  - 2.41.0
  - 2.42.0
  - 2.42.1
  - 2.42.2
  - 2.43.0
  - 2.44.0
  - 2.45.0
  - 2.46.0
  - 2.47.0
  - 2.47.1
  - 2.48.0
  - 2.49.0
  - 2.5.0
  - 2.5.1
  - 2.5.2
  - 2.50.0
  - 2.51.0
  - 2.52.0
  - 2.53.0
  - 2.54.0
  - 2.55.0
  - 2.55.1
  - 2.56.0
  - 2.56.1
  - 2.57.0
  - 2.58.0
  - 2.59.0
  - 2.6.0
  - 2.60.0
  - 2.60.1
  - 2.61.0
  - 2.7.0
  - 2.7.1
  - 2.8.0
  - 2.8.1
  - 2.8.2
  - 2.8.3
  - 2.9.0
references:
- type: ADVISORY
  url: https://nvd.nist.gov/vuln/detail/CVE-2026-31247
- type: PACKAGE
  url: https://github.com/docling-project/docling
- type: WEB
  url: https://www.notion.so/CVE-2026-31247-35d1e1393188818fa654c116c6a470bb
- type: PACKAGE
  url: https://pypi.org/project/docling
- type: ADVISORY
  url: https://github.com/advisories/GHSA-cr42-rg2m-mq4q
severity:
- type: CVSS_V3
  score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H