https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 08 Oct 2026 16:55:38 +0000 https://db.gcve.eu/vuln/cve-2026-105749 <p><strong>Affected:</strong> docling-project docling, docling-project docling-slim</p> <p>Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.0.0 until 2.131.0, the HTML, JATS, OpenDocument spreadsheet, and BoxNote backends, including docling/backend/html_backend.py, docling/backend/jats_backend.py, and docling/backend/boxnote_backend.py, accept the rowspan and colspan attribute values without an upper bound and execute loops or allocate a table grid proportional to the declared span. A very small document can therefore cause sustained CPU use or multi-gigabyte memory allocation, and the document_timeout setting does not interrupt the single backend conversion call. Export through the TableData.grid property can further materialize the oversized grid. This issue is fixed in 2.131.0.</p> <p><strong>Affected:</strong> docling-project docling, docling-project docling-slim</p> <p>Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.0.0 until 2.131.0, the HTML, JATS, OpenDocument spreadsheet, and BoxNote backends, including docling/backend/html_backend.py, docling/backend/jats_backend.py, and docling/backend/boxnote_backend.py, accept the rowspan and colspan attribute values without an upper bound and execute loops or allocate a table grid proportional to the declared span. A very small document can therefore cause sustained CPU use or multi-gigabyte memory allocation, and the document_timeout setting does not interrupt the single backend conversion call. Export through the TableData.grid property can further materialize the oversized grid. This issue is fixed in 2.131.0.</p> https://db.gcve.eu/vuln/cve-2026-105749 https://db.gcve.eu/vuln/ghsa-cgc7-9qp3-86m3 <p><strong>Affected:</strong> PyPI: docling, PyPI: docling-slim</p> <p>### Summary</p> <p>The HTML, JATS, ODS (OpenDocument spreadsheet) and BoxNote backends accept table `rowspan` / `colspan` values without an upper bound. A few bytes of input, such as `&lt;td rowspan=&#34;100000000&#34;&gt;`, make docling run loops proportional to the declared span and allocate a table grid of the declared size. The result is CPU and memory exhaustion.</p> <p>### Details</p> <p>- `docling/backend/html_backend.py` (`_get_cell_spans`) parses span attributes with no upper limit. The cell-filling loop then iterates `row_span × col_span` times. - `docling/backend/jats_backend.py` and `docling/backend/boxnote_backend.py` fill their tables the same way. - The OpenDocument spreadsheet path scans the declared span range. - Export (for example `export_to_markdown()`) materialises the full grid through `TableData.grid` in docling-core.</p> <p>`document_timeout` does not bound this. It is checked between pipeline stages, and these backends convert the whole document in a single call. `max_file_size` and `max_num_pages` do not help because the payload is tiny.</p> <p>Measured on 2.130.0: a 54-byte HTML file with `rowspan=&#34;1e8&#34;` takes about 4.4 s of CPU, and the time grows linearly with the value. A 52-byte file with `colspan=&#34;3000000&#34;` takes about 23 s and reaches 4.5 GB peak memory during Markdown export.</p> <p>### Impact</p> <p>Denial of service of the converting process from a very small input document. Confidentiality and integrity are not affected.</p> <p>### Proof of concept</p> <p>```html &lt;table&gt;&lt;tr&gt;&lt;td colspan=&#34;3000000&#34;&gt;x&lt;/td&gt;&lt;/t…</p> <p><strong>Affected:</strong> PyPI: docling, PyPI: docling-slim</p> <p>### Summary</p> <p>The HTML, JATS, ODS (OpenDocument spreadsheet) and BoxNote backends accept table `rowspan` / `colspan` values without an upper bound. A few bytes of input, such as `&lt;td rowspan=&#34;100000000&#34;&gt;`, make docling run loops proportional to the declared span and allocate a table grid of the declared size. The result is CPU and memory exhaustion.</p> <p>### Details</p> <p>- `docling/backend/html_backend.py` (`_get_cell_spans`) parses span attributes with no upper limit. The cell-filling loop then iterates `row_span × col_span` times. - `docling/backend/jats_backend.py` and `docling/backend/boxnote_backend.py` fill their tables the same way. - The OpenDocument spreadsheet path scans the declared span range. - Export (for example `export_to_markdown()`) materialises the full grid through `TableData.grid` in docling-core.</p> <p>`document_timeout` does not bound this. It is checked between pipeline stages, and these backends convert the whole document in a single call. `max_file_size` and `max_num_pages` do not help because the payload is tiny.</p> <p>Measured on 2.130.0: a 54-byte HTML file with `rowspan=&#34;1e8&#34;` takes about 4.4 s of CPU, and the time grows linearly with the value. A 52-byte file with `colspan=&#34;3000000&#34;` takes about 23 s and reaches 4.5 GB peak memory during Markdown export.</p> <p>### Impact</p> <p>Denial of service of the converting process from a very small input document. Confidentiality and integrity are not affected.</p> <p>### Proof of concept</p> <p>```html &lt;table&gt;&lt;tr&gt;&lt;td colspan=&#34;3000000&#34;&gt;x&lt;/td&gt;&lt;/t…</p> https://db.gcve.eu/vuln/ghsa-cgc7-9qp3-86m3