CyberRota Analysis
AI-GeneratedThe vulnerability affects versions 2.0.0 to 2.131.0 of Docling, specifically in its HTML, JATS, OpenDocument spreadsheet, and BoxNote backends, where unbounded rowspan and colspan attributes can lead to excessive CPU usage and memory allocation. This can result in denial-of-service conditions due to resource exhaustion, as the document_timeout setting fails to terminate the conversion process. Organizations using affected versions should prioritize updating to version 2.131.0 to mitigate these risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.0.0 until 2.131.0, the HTML, JATS, OpenDocument spreadsheet, and BoxNote backends, including docling/backend/html_backend.py, docling/backend/jats_backend.py, and docling/backend/boxnote_backend.py, accept the rowspan and colspan attribute values without an upper bound and execute loops or allocate a table grid proportional to the declared span. A very small document can therefore cause sustained CPU use or multi-gigabyte memory allocation, and the document_timeout setting does not interrupt the single backend conversion call. Export through the TableData.grid property can further materialize the oversized grid. This issue is fixed in 2.131.0.
Related CVEs
Other vulnerabilities affecting the same vendor(s)