Docling Core vulnerabilities

Docling Core versions 1.5.0 through 2.74.1 insufficiently restricted remote request destinations and unsafely processed Content-Disposition headers, allowing access to local files outside the cache directory. This vulnerability enables SSRF attacks in applications that accept untrusted URLs.

A vulnerability in Docling Core (versions 2.5.0 through 2.74.0) allows local file:// image references and accepts inline data: content without a decoded-size limit. This may lead to unauthorized file access or excessive memory consumption.