GHSA-PC36-QWJQ-X68C

Vulnerability from github – Published: 2026-10-07 20:42 – Updated: 2026-10-07 20:42
VLAI
Summary
Docling has SSRF guard bypass in remote resource fetching (DNS rebinding / multi-record resolution; no IP validation in HTML render mode)
Details

Summary

When remote fetching is enabled (enable_remote_fetch=True, together with fetch_images=True or HTML render_page=True), docling's protection against requests to private and loopback addresses can be bypassed.

  • The URL check resolves the host name once, to a single IPv4 address. The HTTP request then resolves it again. A name that returns a public A record together with an internal AAAA record, or one that changes its answer between the two lookups (DNS rebinding), reaches internal addresses.
  • The check and the HTTP request parse the URL differently. With a backslash in the authority, such as http://127.0.0.1:8080\@1.1.1.1/x.png, the check validates 1.1.1.1 while the HTTP client connects to 127.0.0.1:8080.
  • In HTML browser-rendering mode (render_page=True), requests made by the page are allowed for any http(s) URL without an IP check.

Details

  • validate_url_safety in docling/backend/utils/image_resource_loader.py calls socket.gethostbyname(), which returns one IPv4 address. It checks that address and then passes the original URL string to requests, which parses it again with urllib3 and resolves the name independently through getaddrinfo. urllib.parse treats a backslash in the authority as part of the host section, while urllib3 ends the authority there, so the two can pick different hosts. This loader is shared by the HTML, Markdown, AsciiDoc, OpenDocument and JATS backends.
  • docling/backend/html_backend.py routes browser requests in render mode. When enable_remote_fetch is set, it continues any http(s) request, including iframes and images, without resolving or checking the destination.

JavaScript is disabled during rendering, so the browser path can only show internal responses passively in the page screenshot. It cannot read them and send them elsewhere.

Affected configurations

  • Affected: callers that enable enable_remote_fetch (CLI: --html-image-fetch remote or all) and process untrusted documents.
  • Not affected: the default configuration (enable_remote_fetch=False).

The main-URL fetch for DocumentConverter.convert("https://...") is implemented in docling-core and is tracked there.

Impact

Requests from the converting host to internal services such as cloud metadata endpoints and loopback services. Response content is exposed only when it decodes as an image or is rendered into the page screenshot.

Patches

Fixed in docling 2.132.0 by #4420. The image loader now resolves the host once, requires every resolved address (IPv4 and IPv6, including IPv4-mapped, 6to4 and NAT64 forms) to be globally routable, and connects to one of the validated addresses, using the same parsed host for the check and the connection. Remote requests made during HTML browser rendering are downloaded by the same loader, and the browser itself stays offline. When a proxy is configured through environment variables, requests go through the proxy, which is then responsible for filtering destinations.

Workarounds

Upgrade to 2.132.0. For older versions:

Keep enable_remote_fetch=False for untrusted documents, or block egress to private, link-local and loopback ranges at the network level.

Severity
4.0 (Medium)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "docling"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.91.0"
            },
            {
              "fixed": "2.132.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "docling-slim"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.92.0"
            },
            {
              "fixed": "2.132.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-105743"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-367",
      "CWE-918"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-10-07T20:42:19Z",
    "nvd_published_at": "2026-10-05T22:16:57Z",
    "severity": "MODERATE"
  },
  "details": "### Summary\n\nWhen remote fetching is enabled (`enable_remote_fetch=True`, together with `fetch_images=True` or HTML `render_page=True`), docling\u0027s protection against requests to private and loopback addresses can be bypassed.\n\n- The URL check resolves the host name once, to a single IPv4 address. The HTTP request then resolves it again. A name that returns a public A record together with an internal AAAA record, or one that changes its answer between the two lookups (DNS rebinding), reaches internal addresses.\n- The check and the HTTP request parse the URL differently. With a backslash in the authority, such as `http://127.0.0.1:8080\\@1.1.1.1/x.png`, the check validates `1.1.1.1` while the HTTP client connects to `127.0.0.1:8080`.\n- In HTML browser-rendering mode (`render_page=True`), requests made by the page are allowed for any `http(s)` URL without an IP check.\n\n### Details\n\n- `validate_url_safety` in `docling/backend/utils/image_resource_loader.py` calls `socket.gethostbyname()`, which returns one IPv4 address. It checks that address and then passes the original URL string to `requests`, which parses it again with urllib3 and resolves the name independently through `getaddrinfo`. `urllib.parse` treats a backslash in the authority as part of the host section, while urllib3 ends the authority there, so the two can pick different hosts. This loader is shared by the HTML, Markdown, AsciiDoc, OpenDocument and JATS backends.\n- `docling/backend/html_backend.py` routes browser requests in render mode. When `enable_remote_fetch` is set, it continues any `http(s)` request, including iframes and images, without resolving or checking the destination.\n\nJavaScript is disabled during rendering, so the browser path can only show internal responses passively in the page screenshot. It cannot read them and send them elsewhere.\n\n### Affected configurations\n\n- Affected: callers that enable `enable_remote_fetch` (CLI: `--html-image-fetch remote` or `all`) and process untrusted documents.\n- Not affected: the default configuration (`enable_remote_fetch=False`).\n\nThe main-URL fetch for `DocumentConverter.convert(\"https://...\")` is implemented in docling-core and is tracked there.\n\n### Impact\n\nRequests from the converting host to internal services such as cloud metadata endpoints and loopback services. Response content is exposed only when it decodes as an image or is rendered into the page screenshot.\n\n### Patches\n\nFixed in docling 2.132.0 by [#4420](https://github.com/docling-project/docling/pull/4420). The image loader now resolves the host once, requires every resolved address (IPv4 and IPv6, including IPv4-mapped, 6to4 and NAT64 forms) to be globally routable, and connects to one of the validated addresses, using the same parsed host for the check and the connection. Remote requests made during HTML browser rendering are downloaded by the same loader, and the browser itself stays offline. When a proxy is configured through environment variables, requests go through the proxy, which is then responsible for filtering destinations.\n\n### Workarounds\n\nUpgrade to 2.132.0. For older versions:\n\nKeep `enable_remote_fetch=False` for untrusted documents, or block egress to private, link-local and loopback ranges at the network level.",
  "id": "GHSA-pc36-qwjq-x68c",
  "modified": "2026-10-07T20:42:19Z",
  "published": "2026-10-07T20:42:19Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/docling-project/docling/security/advisories/GHSA-pc36-qwjq-x68c"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-105743"
    },
    {
      "type": "WEB",
      "url": "https://github.com/docling-project/docling/pull/4420"
    },
    {
      "type": "WEB",
      "url": "https://github.com/docling-project/docling/commit/5e469137f275ffc443306a30d12a3a45bceb80fb"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/docling-project/docling"
    },
    {
      "type": "WEB",
      "url": "https://github.com/docling-project/docling/releases/tag/v2.132.0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Docling has SSRF guard bypass in remote resource fetching (DNS rebinding / multi-record resolution; no IP validation in HTML render mode)"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.