Docling: Unsafe Archive Extraction and XML Parsing in METS-GBS Backend
Medium5.5CVE-2026-44018 · Published Jun 3, 2026 · updated Jul 21, 2026
### Impact The METS-GBS backend's XML parsing and the input document format detection lacked security controls, enabling: - XML External Entity (XXE) attacks to read local files or cause denial of service - Decompression bombs (zip bombs) to exhaust memory and disk space - Unbounded archive extraction consuming system resources An attacker could craft malicious METS-GBS archives that, when processed, could read sensitive files, exhaust system resources, or cause application crashes. ### Patches Fixed in version 2.91.0. The fix implements: - Secure XML parsing with `resolve_entities=False`, `load_dtd=False`, and `no_network=True` - Configurable limits: 300 MB total extraction size, 10 MB per file, 1000 member count - Cumulative size tracking across all extractions - Early termination when limits are exceeded - Secure format detection of METS-GBS tar archives with `_detect_mets_gbs()` method: maximum file size (10 MB per file), maximum member count (1000 members), and exception handling to gracefully fail when limits are exceeded ### Workarounds Avoid processing METS-GBS archives from untrusted sources. If necessary, pre-validate archives in an isolated environment with resource l...
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| docling PyPI | >= 2.45.0, < 2.91.0 | 2.91.0 |
Details and references
### Impact The METS-GBS backend's XML parsing and the input document format detection lacked security controls, enabling: - XML External Entity (XXE) attacks to read local files or cause denial of service - Decompression bombs (zip bombs) to exhaust memory and disk space - Unbounded archive extraction consuming system resources An attacker could craft malicious METS-GBS archives that, when processed, could read sensitive files, exhaust system resources, or cause application crashes. ### Patches Fixed in version 2.91.0. The fix implements: - Secure XML parsing with `resolve_entities=False`, `load_dtd=False`, and `no_network=True` - Configurable limits: 300 MB total extraction size, 10 MB per file, 1000 member count - Cumulative size tracking across all extractions - Early termination when limits are exceeded - Secure format detection of METS-GBS tar archives with `_detect_mets_gbs()` method: maximum file size (10 MB per file), maximum member count (1000 members), and exception handling to gracefully fail when limits are exceeded ### Workarounds Avoid processing METS-GBS archives from untrusted sources. If necessary, pre-validate archives in an isolated environment with resource limits. ### References - Fix release: [v2.91.0](https://github.com/docling-project/docling/releases/tag/v2.91.0)
More docling advisories
All docling| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Jun 3 | Docling: Unsafe URI and Path Handling in HTML Backend High7.1Jun 3 | High7.1 | 2.94.0 |
| Jun 3 | Docling: Potential Path Traversal via LaTeX \includegraphics and \input CommandsMedium5.5Jun 3 | Medium5.5 | 2.91.0 |
| Jun 3 | Docling: Unsafe XML Entity Expansion in USPTO Patent BackendHigh7.5Jun 3 | High7.5 | 2.74.0 |
| Jun 3 | Docling: Unsafe Playwright-based HTML RenderingHigh8.2Jun 3 | High8.2 | 2.91.0 |
| Jun 3 | Docling: Unsafe Zip Extraction in EasyOCR Model DownloadHigh7.5Jun 3 | High7.5 | 2.91.0 |
| May 11 | Docling's METS GBS backend is vulnerable to XML Entity Expansion (XXE) attacksHigh7.5May 11 | High7.5 | No fix yet |