CVE-2026-105743: Docling has SSRF guard bypass in remote resource fetching (DNS rebinding / multi-record resolution; no IP validation in HTML render mode)

When remote fetching is enabled (enable_remote_fetch=True, together with fetch_images=True or HTML render_page=True), docling’s protection against requests to private and loopback addresses can be bypassed.

• The URL check resolves the host name once, to a single IPv4 address. The HTTP request then resolves it again. A name that returns a public A record together with an internal AAAA record, or one that changes its answer between the two lookups (DNS rebinding), reaches internal addresses.
• The check and the HTTP request parse the URL differently. With a backslash in the authority, such as http://127.0.0.1:8080\@1.1.1.1/x.png, the check validates 1.1.1.1 while the HTTP client connects to 127.0.0.1:8080.
• In HTML browser-rendering mode (render_page=True), requests made by the page are allowed for any http(s) URL without an IP check.