Advisory Database
  • Advisories
  • Dependency Scanning
  1. pypi
  2. ›
  3. docling-slim
  4. ›
  5. GHSA-3cr3-8m4c-fpxw

GHSA-3cr3-8m4c-fpxw: Docling: METS-GBS archive member limit enforced after full member enumeration (memory exhaustion during format detection)

October 6, 2026

When docling detects the input format of a gzip-compressed tar archive (METS-GBS), and later when the METS-GBS backend opens it, it calls tarfile.TarFile.getmembers(). That builds the full member list in memory before the max_member_count limit is checked. A small archive with a very large number of empty members therefore makes docling allocate memory in proportion to the member count, and the limit has no effect.

References

  • github.com/advisories/GHSA-3cr3-8m4c-fpxw
  • github.com/docling-project/docling/commit/ebae65cd71c37c88b36185b406a449b92d8f7ffa
  • github.com/docling-project/docling/pull/4412
  • github.com/docling-project/docling/releases/tag/v2.131.0
  • github.com/docling-project/docling/security/advisories/GHSA-3cr3-8m4c-fpxw
  • nvd.nist.gov/vuln/detail/CVE-2026-105747

Code Behaviors & Features

Detect and mitigate GHSA-3cr3-8m4c-fpxw with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →

Affected versions

All versions starting from 2.92.0 before 2.131.0

Fixed versions

  • 2.131.0

Solution

Upgrade to version 2.131.0 or above.

Impact 4.3 MEDIUM

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

Learn more about CVSS

Weakness

  • CWE-409: Improper Handling of Highly Compressed Data (Data Amplification)
  • CWE-770: Allocation of Resources Without Limits or Throttling

Source file

pypi/docling-slim/GHSA-3cr3-8m4c-fpxw.yml

Spotted a mistake? Edit the file on GitLab.

  • Site Repo
  • About GitLab
  • Terms
  • Privacy Statement
  • Contact

Page generated Sun, 08 Nov 2026 00:15:18 +0000.