CVE-2026-44019 — HIGH (8.1)

Vulnerability Description

Docling Core defines core data types and transformations for the document processing application Docling. In versions 2.5.0 and above, prior to 2.74.1, docling-core could allow local file:// image references and accepted inline data: content without a decoded-size limit. In applications that accept untrusted image references, this may allow access to local files readable by the process or excessive memory use from large inline payloads. This issue has been fixed in version 2.74.1.

CVSS Score

8.1

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality

HIGH

Integrity

NONE

Availability

HIGH

Related Weaknesses (CWE)

CWE-400 CWE-73

References

FAQ

What is CVE-2026-44019?

CVE-2026-44019 is a vulnerability with a CVSS score of 8.1 (HIGH). Docling Core defines core data types and transformations for the document processing application Docling. In versions 2.5.0 and above, prior to 2.74.1, docling-core could allow local file:// image ref...

How severe is CVE-2026-44019?

CVE-2026-44019 has been rated HIGH with a CVSS base score of 8.1/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2026-44019?

Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.