CVE-2026-105749: Docling: Unbounded table rowspan/colspan in HTML, JATS, ODS and BoxNote backends causes CPU/memory exhaustion
The HTML, JATS, ODS (OpenDocument spreadsheet) and BoxNote backends accept table rowspan / colspan values without an upper bound. A few bytes of input, such as <td rowspan="100000000">, make docling run loops proportional to the declared span and allocate a table grid of the declared size. The result is CPU and memory exhaustion.
References
- github.com/advisories/GHSA-cgc7-9qp3-86m3
- github.com/docling-project/docling/commit/c5b4429cc6500a344c13edeb22e67610c2159b09
- github.com/docling-project/docling/pull/4414
- github.com/docling-project/docling/releases/tag/v2.131.0
- github.com/docling-project/docling/security/advisories/GHSA-cgc7-9qp3-86m3
- nvd.nist.gov/vuln/detail/CVE-2026-105749
Code Behaviors & Features
Detect and mitigate CVE-2026-105749 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →