CVE-2026-105743: Docling: SSRF guard bypass in remote resource fetching (DNS rebinding / multi-record resolution; no IP validation in HTML render mode)
Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.91.0 until 2.132.0, validateurlsafety in docling/backend/utils/imageresourceloader.py validates a hostname with a single IPv4 lookup and then allows the HTTP client to resolve and parse the original URL again, permitting DNS rebinding, mixed public and internal address records, and backslash authority parser disagreement to reach internal services. HTMLBackendOptions(renderpage=True) also allows HTTP and HTTPS browser requests without validating their resolved destination. Exploitation requires remote fetching to be enabled, and response content is exposed only when it is decoded as an image or passively rendered in a page screenshot. This issue is fixed in 2.132.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Doclingto a version that resolves this vulnerability.Fixed in 2.132.0
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using Docling versions from 2.91.0 up to, but not including, 2.132.0 are affected when remote fetching is enabled. HTML rendering with HTMLBackendOptions(render_page=True) is also affected because browser HTTP and HTTPS requests do not validate the resolved destination.
What does an attacker need to exploit it?
An attacker needs a way to cause Docling to fetch a remotely hosted resource. They can use DNS rebinding, hostnames with both public and internal address records, or backslash-based URL authority parsing differences to direct fetching toward internal services.
When can an attacker obtain internal response content?
Response content is exposed only if the fetched response is decoded as an image or is passively rendered into a page screenshot. The issue does not state that arbitrary internal HTTP responses are directly returned.
What should be done if upgrading cannot happen immediately?
Disable remote fetching where possible. Avoid using HTMLBackendOptions(render_page=True), and restrict the environment's network access to internal services and sensitive address ranges until Docling can be updated to 2.132.0.