CyberRota Analysis
AI-GeneratedThe vulnerability affects the Docling document processing tool, specifically in versions 2.45.0 to 2.131.0, where improper handling of tar archive member counts can lead to excessive memory consumption during format detection. This can be exploited using a specially crafted gzip-compressed tar archive, potentially resulting in denial of service due to resource exhaustion. Organizations using affected versions should prioritize patching to version 2.131.0 to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.45.0 until 2.131.0, METS-GBS format detection in docling/datamodel/document.py and the backend in docling/backend/mets_gbs_backend.py call tarfile.TarFile.getmembers() before enforcing the max_member_count limit, causing the full archive member list to be allocated before the limit can stop processing. A small gzip-compressed tar archive with a very large number of empty members can therefore consume memory proportional to the declared member count, including during format detection before the allowed_formats restriction is applied. This issue is a residual weakness in the member-count protection added for CVE-2026-44018. This issue is fixed in 2.131.0.
Related CVEs
Other vulnerabilities affecting the same vendor(s)