{"cve":"CVE-2026-44019","nvd":{"published":"2026-07-16T21:17:20.917","modified":"2026-10-24T20:10:00.137","status":"Deferred","description":"Docling Core defines core data types and transformations for the document processing application Docling. In versions 2.5.0 and above, prior to 2.74.1, docling-core could allow local file:// image references and accepted inline data: content without a decoded-size limit. In applications that accept untrusted image references, this may allow access to local files readable by the process or excessive memory use from large inline payloads. This issue has been fixed in version 2.74.1.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","score":8.1},"cwes":["CWE-73","CWE-400"],"references":["https://github.com/docling-project/docling-core/releases/tag/v2.74.1","https://github.com/docling-project/docling-core/security/advisories/GHSA-j5xp-7m2f-49jv"],"products":[],"source":"nvd","synced_at":"2026-10-25T17:50:08.599881581+00:00"},"epss":{"cve":"CVE-2026-44019","score":0.00419,"percentile":0.35891,"date":"2026-10-25"},"kev":null,"osv":[{"id":"GHSA-j5xp-7m2f-49jv","url":"https://osv.dev/vulnerability/GHSA-j5xp-7m2f-49jv","summary":"Docling Core: Insufficient validation of image reference URIs","modified":"2026-07-13T16:43:49.284243969Z","packages":[{"ecosystem":"PyPI","name":"docling-core","purl":"pkg:pypi/docling-core","ranges":[">=2.5.0 <2.74.1"],"fixed":["2.74.1"]}]},{"id":"PYSEC-2026-2456","url":"https://osv.dev/vulnerability/PYSEC-2026-2456","summary":"Docling Core: Insufficient validation of image reference URIs","modified":"2026-07-13T16:31:39.985553936Z","packages":[{"ecosystem":"PyPI","name":"docling-core","purl":"pkg:pypi/docling-core","ranges":[">=2.5.0 <2.74.1"],"fixed":["2.74.1"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}