https://vulnerability.circl.lu/sightings/feed 2026-10-08T12:33:49.365446+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/38c6813c-1351-458a-8319-8026fe38c29f/export 2026-10-08T12:33:49.398228+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "38c6813c-1351-458a-8319-8026fe38c29f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-105742", "type": "seen", "source": "https://gist.github.com/alon710/072780d27ae75b0a4f396a84940a84bb", "content": "# CVE-2026-105742: CVE-2026-105742: Sensitive Custom Header Leakage in Docling Image Resource Loader\n\n> **CVSS Score:** 3.7\n> **Published:** 2026-10-07\n> **Full Report:** https://cvereports.com/reports/CVE-2026-105742\n\n## Summary\nA technical analysis of CVE-2026-105742 (GHSA-p3fw-7699-7926), a sensitive information disclosure vulnerability in the Docling document processing library. Vulnerable versions of Docling indiscriminately forward custom HTTP headers, such as authentication tokens, to arbitrary third-party origins and during cross-origin redirects while fetching remote image assets from untrusted HTML and EPUB documents.\n\n## TL;DR\nDocling versions before 2.132.0 leak custom HTTP authentication headers configured in HTMLBackendOptions.headers to arbitrary third-party domains when retrieving remote images embedded in processed documents or during cross-origin redirects.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-201 / CWE-522\n- **Attack Vector**: Network (AV:N)\n- **CVSS Severity**: 3.7 (Low)\n- **EPSS Score**: 0.00218 (Percentile: 11.24%)\n- **Exploit Status**: Proof-of-Concept\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- docling\n- docling-slim\n- **docling**: >= 2.95.0, < 2.132.0 (Fixed in: `2.132.0`)\n- **docling-slim**: >= 2.95.0, < 2.132.0 (Fixed in: `2.132.0`)\n\n## Mitigation\n\n- Upgrade docling and docling-slim dependencies to version 2.132.0 or higher.\n- Configure explicit allowed origins using headers_allowed_origins in backend options.\n- Disable remote resource fetching (enable_remote_fetch=False) when handling untrusted documents.\n\n**Remediation Steps:**\n1. Identify all service deployments utilizing docling and docling-slim.\n2. Update requirements.txt, pyproject.toml, or poetry configurations to request docling>=2.132.0.\n3. Locate HTMLBackendOptions initializations and supply explicit hosts within the headers_allowed_origins configuration parameter.\n4. Redeploy services and monitor logs for warning messages indicating unauthorized origin attempts.\n\n## References\n\n- [GitHub Security Advisory GHSA-p3fw-7699-7926](https://github.com/docling-project/docling/security/advisories/GHSA-p3fw-7699-7926)\n- [Docling Release Tag v2.132.0](https://github.com/docling-project/docling/releases/tag/v2.132.0)\n- [NVD - CVE-2026-105742 Detail](https://nvd.nist.gov/vuln/detail/CVE-2026-105742)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-105742) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-10-08T05:30:30.000000Z"} 2026-10-08T05:30:30+00:00 https://vulnerability.circl.lu/sighting/9b68ed91-6b5c-46cc-9f0a-6812ea988598/export 2026-10-08T12:33:49.401030+00:00 Joseph Lee https://cve.circl.lu/user/syspect {"uuid": "9b68ed91-6b5c-46cc-9f0a-6812ea988598", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-105742", "type": "published-proof-of-concept", "source": "https://github.com/docling-project/docling/security/advisories/GHSA-p3fw-7699-7926", "content": "", "creation_timestamp": "2026-10-01T11:55:46.000000Z"} 2026-10-01T11:55:46+00:00