p PatchFirst

CVE-2026-105747

CVE-2026-105747 · Docling: METS-GBS archive member limit enforced after full member enumeration (memory exhaustion during format detection)

Здесь приведены факты из открытых источников об уязвимостях. Перед обновлением ознакомьтесь с исходным сообщением.

Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.45.0 until 2.131.0, METS-GBS format detection in docling/datamodel/document.py and the backend in docling/backend/mets_gbs_backend.py call tarfile.TarFile.getmembers() before enforcing the max_member_count limit, causing the full archive member list to be allocated before the limit can stop processing. A small gzip-compressed tar archive with a very large number of empty members can therefore consume memory proportional to the declared member count, including during format detection before the allowed_formats restriction is applied. This issue is a residual weakness in the member-count protection added for CVE-2026-44018. This issue is fixed in 2.131.0.

CVSS 4.3 · Средний · EPSS 0,3% · Есть исправление

Опубликовано
Обновлено

Стек: python

Затронутые продукты и версии

  • docling

    Версии
    • >= 2.45.0, < 2.131.0: Затронуто

    Нет опубликованного исправления

  • docling-slim

    Версии
    • >= 2.45.0, < 2.131.0: Затронуто

    Нет опубликованного исправления

  • docling PyPI

    Версии
    • 2.100.0
    • 2.101.0
    • 2.102.0
    • 2.102.1
    • 2.102.2
    • 2.103.0
    • 2.104.0
    • 2.105.0
    • 2.106.0
    • 2.107.0
    • 2.108.0
    • 2.109.0
    • 2.110.0
    • 2.111.0
    • 2.112.0
    • 2.113.0
    • 2.114.0
    • 2.115.0
    • 2.116.0
    • 2.117.0
    • 2.118.0
    • 2.118.1
    • 2.119.0
    • 2.120.1
    • 2.120.2
    • 2.120.3
    • 2.121.0
    • 2.122.0
    • 2.123.0
    • 2.123.1
    • 2.124.0
    • 2.125.0
    • 2.126.0
    • 2.127.0
    • 2.128.0
    • 2.129.0
    • 2.130.0
    • 2.45.0
    • 2.46.0
    • 2.47.0
    • 2.47.1
    • 2.48.0
    • 2.49.0
    • 2.50.0
    • 2.51.0
    • 2.52.0
    • 2.53.0
    • 2.54.0
    • 2.55.0
    • 2.55.1
    • 2.56.0
    • 2.56.1
    • 2.57.0
    • 2.58.0
    • 2.59.0
    • 2.60.0
    • 2.60.1
    • 2.61.0
    • 2.61.1
    • 2.61.2
    • 2.62.0
    • 2.63.0
    • 2.64.0
    • 2.64.1
    • 2.65.0
    • 2.66.0
    • 2.67.0
    • 2.68.0
    • 2.69.0
    • 2.69.1
    • 2.70.0
    • 2.71.0
    • 2.72.0
    • 2.73.0
    • 2.73.1
    • 2.74.0
    • 2.75.0
    • 2.76.0
    • 2.77.0
    • 2.78.0
    • 2.79.0
    • 2.80.0
    • 2.81.0
    • 2.82.0
    • 2.83.0
    • 2.84.0
    • 2.85.0
    • 2.86.0
    • 2.87.0
    • 2.88.0
    • 2.89.0
    • 2.90.0
    • 2.91.0
    • 2.92.0
    • 2.93.0
    • 2.94.0
    • 2.95.0
    • 2.96.0
    • 2.96.1
    • 2.97.0
    • 2.98.0
    • 2.99.0
    Затронутые диапазоны версий
    • ECOSYSTEM: ≥ 2.45.0, < 2.131.0

    Обновитесь до 2.131.0

  • docling-slim PyPI

    Версии
    • 2.100.0
    • 2.101.0
    • 2.102.0
    • 2.102.1
    • 2.102.2
    • 2.103.0
    • 2.104.0
    • 2.105.0
    • 2.106.0
    • 2.107.0
    • 2.108.0
    • 2.109.0
    • 2.110.0
    • 2.111.0
    • 2.112.0
    • 2.113.0
    • 2.114.0
    • 2.115.0
    • 2.116.0
    • 2.117.0
    • 2.118.0
    • 2.118.1
    • 2.119.0
    • 2.120.1
    • 2.120.2
    • 2.120.3
    • 2.121.0
    • 2.122.0
    • 2.123.0
    • 2.123.1
    • 2.124.0
    • 2.125.0
    • 2.126.0
    • 2.127.0
    • 2.128.0
    • 2.129.0
    • 2.130.0
    • 2.92.0
    • 2.93.0
    • 2.94.0
    • 2.95.0
    • 2.96.0
    • 2.96.1
    • 2.97.0
    • 2.98.0
    • 2.99.0
    Затронутые диапазоны версий
    • ECOSYSTEM: ≥ 2.92.0, < 2.131.0

    Обновитесь до 2.131.0

Первоисточники

Проверьте свой сервер →