Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.91.0 until 2.132.0, validate_url_safety in docling/backend/utils/image_resource_loader.py validates a hostname with a single IPv4 lookup and then allows the HTTP client to resolve and parse the original URL again, permitting DNS rebinding, mixed public and internal address records, and backslash authority parser disagreement to reach internal services. HTMLBackendOptions(render_page=True) also allows HTTP and HTTPS browser requests without validating their resolved destination. Exploitation requires remote fetching to be enabled, and response content is exposed only when it is decoded as an image or passively rendered in a page screenshot. This issue is fixed in 2.132.0.

Affected: PyPI: docling, PyPI: docling-slim

### Summary

When remote fetching is enabled (`enable_remote_fetch=True`, together with `fetch_images=True` or HTML `render_page=True`), docling's protection against requests to private and loopback addresses can be bypassed.

- The URL check resolves the host name once, to a single IPv4 address. The HTTP request then resolves it again. A name that returns a public A record together with an internal AAAA record, or one that changes its answer between the two lookups (DNS rebinding), reaches internal addresses. - The check and the HTTP request parse the URL differently. With a backslash in the authority, such as `http://127.0.0.1:8080\@1.1.1.1/x.png`, the check validates `1.1.1.1` while the HTTP client connects to `127.0.0.1:8080`. - In HTML browser-rendering mode (`render_page=True`), requests made by the page are allowed for any `http(s)` URL without an IP check.

### Details

- `validate_url_safety` in `docling/backend/utils/image_resource_loader.py` calls `socket.gethostbyname()`, which returns one IPv4 address. It checks that address and then passes the original URL string to `requests`, which parses it again with urllib3 and resolves the name independently through `getaddrinfo`. `urllib.parse` treats a backslash in the authority as part of the host section, while urllib3 ends the authority there, so the two can pick different hosts. This loader is shared by the HTML, Markdown, AsciiDoc, OpenDocument and JATS backends. - `docling/backend/html_backend.py` routes browser r…

Affected: PyPI: docling

Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.91.0 until 2.132.0, validate_url_safety in docling/backend/utils/image_resource_loader.py validates a hostname with a single IPv4 lookup and then allows the HTTP client to resolve and parse the original URL again, permitting DNS rebinding, mixed public and internal address records, and backslash authority parser disagreement to reach internal services. HTMLBackendOptions(render_page=True) also allows HTTP and HTTPS browser requests without validating their resolved destination. Exploitation requires remote fetching to be enabled, and response content is exposed only when it is decoded as an image or passively rendered in a page screenshot. This issue is fixed in 2.132.0.