Skip to content
Fencer Vulns
critical 9.4

CVE-2026-44020 json

Docling: Unsafe XML Entity Expansion in USPTO Patent Backend

published 2026-06-03 5 mo ago modified 2026-10-25 14 d ago also GHSA-m88r-rg27-5xfg , PYSEC-2026-240 , EUVD-2026-39004

cvss
9.4
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.6%
EPSS 0.6% chance of exploitation in 30 days, percentile 49%
public exploits
0
none known

Summary

Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.13.0 until 2.74.0, the USPTO patent XML parser used the standard xml.sax.parseString() without protection against XML External Entity (XXE) attacks. An attacker could craft malicious USPTO patent XML files with external entity references that could read arbitrary files from the server filesystem, perform Server-Side Request Forgery (SSRF) attacks, or cause denial of service through entity expansion (Billion Laughs attack). The vulnerability affects three USPTO patent format parsers: ICE (v4.x), Grant v2.5, and Application v1.x. This vulnerability is fixed in 2.74.0.

Patch / fix

  • pypi docling 2.74.0
  • Red Hat Red Hat OpenShift AI 3.4 1786612637

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-44020 updated cvss 9.4

docling: Docling: Information disclosure via XML External Entity (XXE) vulnerability

  • Red Hat OpenShift AI 3.4 rhoai/odh-autorag-rhel9 1786612637
    fixed: vendor fix RHSA-2026:60520
  • Red Hat OpenShift AI 3.4 rhoai/odh-cli-rhel9 1787330837, rhoai/rhai-cli-rhel9 1787330837, rhoai/odh-automl-rhel9 1786612415, rhoai/odh-mlflow-rhel9 1787226790, rhoai/odh-trainer-rhel9 1787089049, rhoai/odh-eval-hub-rhel9 1787087463, +99 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
partial
Assessed
4 mo ago

Exploit prediction

0.60% chance of exploitation in the next 30 days, higher than 49% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CISA ADP 3.1 9.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H
CNA 3.1 9.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H
GitHub 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
OSV 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected packages

ecosystem package affected fixed in
pypi docling
>=2.13.0, <2.74.0
2.74.0

Affected products

  • docling-project docling
  • Red Hat Red Hat OpenShift AI 3.4

Classification

Weakness
  • CWE-776 Improper Restriction of Recursive Entity References in DTDs
  • CWE-611 Improper Restriction of XML External Entity Reference

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.