CVE-2026-44018: Docling: Unsafe Archive Extraction and XML Parsing in METS-GBS Backend
Impact The METS-GBS backend's XML parsing and the input document format detection lacked security controls, enabling: - XML External Entity (XXE) attacks to read local files or cause denial of service - Decompression bombs (zip bombs) to exhaust memory and disk space - Unbounded archive extraction consuming system resources
An attacker could craft malicious METS-GBS archives that, when processed, could read sensitive files, exhaust system resources, or cause application crashes.
Patches Fixed in version 2.91.0. The fix implements: - Secure XML parsing with resolveentities=False, loaddtd=False, and nonetwork=True - Configurable limits: 300 MB total extraction size, 10 MB per file, 1000 member count - Cumulative size tracking across all extractions - Early termination when limits are exceeded - Secure format detection of METS-GBS tar archives with detectmetsgbs() method: maximum file size (10 MB per file), maximum member count (1000 members), and exception handling to gracefully fail when limits are exceeded
Workarounds Avoid processing METS-GBS archives from untrusted sources. If necessary, pre-validate archives in an isolated environment with resource limits.
References - Fix release: v2.91.0
Other sources
Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.45.0 until 2.91.0, the METS-GBS backend's XML parsing and the input document format detection lacked security controls. An attacker could craft malicious METS-GBS archives that, when processed, could read sensitive files, exhaust system resources, or cause application crashes. This vulnerability is fixed in 2.91.0.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/doclingto a version that resolves this vulnerability.Fixed in 2.91.0 - Upgrade
Upgrade
Docling METS-GBS backendto a version that resolves this vulnerability.Fixed in 2.91.0 - Configuration
Configure secure XML parsing for METS-GBS by setting resolve_entities=False.
METS-GBS XML parsing resolve_entities = False - Configuration
Configure secure XML parsing for METS-GBS by setting load_dtd=False.
METS-GBS XML parsing load_dtd = False - Configuration
Configure secure XML parsing for METS-GBS by setting no_network=True.
METS-GBS XML parsing no_network = True - Configuration
Set METS-GBS tar archive limits so the maximum file size is 10 MB per file.
METS-GBS tar archive detection/extraction max_file_size_per_file = 10 MB - Configuration
Set METS-GBS tar archive limits so the maximum member count is 1000 members.
METS-GBS tar archive detection/extraction max_member_count = 1000 - Configuration
Set METS-GBS tar archive limits so total extraction size is limited to 300 MB across all extractions.
METS-GBS tar archive detection/extraction max_total_extraction_size = 300 MB - Compensating control
Pre-validate METS-GBS archives in an isolated environment with resource limits.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-44018?
The severity of CVE-2026-44018 is medium with a score of 5.5.
What types of attacks are associated with CVE-2026-44018?
CVE-2026-44018 is associated with XML External Entity (XXE) attacks, decompression bombs, and unbounded archive extraction.
How do I fix CVE-2026-44018?
To fix CVE-2026-44018, ensure that proper security controls are implemented in the XML parsing and input document format detection mechanisms.
What software is affected by CVE-2026-44018?
CVE-2026-44018 affects the backend of the METS-GBS software, particularly the pip/docling library.
What is the impact of exploiting CVE-2026-44018?
Exploiting CVE-2026-44018 can lead to unauthorized file access, denial of service, and resource exhaustion.