Summary
Docling has SSRF guard bypass in remote resource fetching (DNS rebinding / multi-record resolution; no IP validation in HTML render mode)
When remote fetching is enabled (enable_remote_fetch=True, together with fetch_images=True or HTML render_page=True), docling's protection against requests to private and loopback addresses can be bypassed.
- The URL check resolves the host name once, to a single IPv4 address. The HTTP request then resolves it again. A name that returns a public A record together with an internal AAAA record, or one that changes its answer between the two lookups (DNS rebinding), reaches internal addresses.
- The check and the HTTP request parse the URL differently. With a backslash in the authority, such as
http://127.0.0.1:8080\@1.1.1.1/x.png, the check validates1.1.1.1while the HTTP client connects to127.0.0.1:8080. - In HTML browser-rendering mode (
render_page=True), requests made by the page are allowed for anyhttp(s)URL without an IP check.
Details
validate_url_safetyindocling/backend/utils/image_resource_loader.pycallssocket.gethostbyname(), which returns one IPv4 address. It checks that address and then passes the original URL string torequests, which parses it again with urllib3 and resolves the name independently throughgetaddrinfo.urllib.parsetreats a backslash in the authority as part of the host section, while urllib3 ends the authority there, so the two can pick different hosts. This loader is shared by the HTML, Markdown, AsciiDoc, OpenDocument and JATS backends.docling/backend/html_backend.pyroutes browser requests in render mode. Whenenable_remote_fetchis set, it continues anyhttp(s)request, including iframes and images, without resolving or checking the destination.
JavaScript is disabled during rendering, so the browser path can only show internal responses passively in the page screenshot. It cannot read them and send them elsewhere.
Affected configurations
- Affected: callers that enable
enable_remote_fetch(CLI:--html-image-fetch remoteorall) and process untrusted documents. - Not affected: the default configuration (
enable_remote_fetch=False).
The main-URL fetch for DocumentConverter.convert("https://...") is implemented in docling-core and is tracked there.
Workarounds
Upgrade to 2.132.0. For older versions:
Keep enable_remote_fetch=False for untrusted documents, or block egress to private, link-local and loopback ranges at the network level.
Impact
Requests from the converting host to internal services such as cloud metadata endpoints and loopback services. Response content is exposed only when it decodes as an image or is rendered into the page screenshot.
Untrusted input controls the target URL of a server-initiated request, which may reach internal services not otherwise accessible from outside. Typical impact: access to internal metadata services, internal APIs, or cloud credentials.
CVE-2026-105743 has a CVSS score of 4.0 (Medium). The vector is network-reachable, no privileges required, and no user interaction. A CVSS score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether this affects your application depends on whether the vulnerable code is present and reachable in your environment. A fixed version is available (2.132.0); upgrading removes the vulnerable code path.
Affected versions
Security releases
Kodem intelligence
Severity tells you how bad this could be in the worst case. It does not tell you whether you are exposed. Exploitability and impact are functions of runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A vulnerable package can sit in your dependency tree and never run.
Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter. Kodem's runtime-powered SCA identifies whether this CVE is reachable in your applications.
Already deployed Kodem?
See it in your environmentNew to Kodem? Get a demo →Remediation advice
Fixed in docling 2.132.0 by #4420. The image loader now resolves the host once, requires every resolved address (IPv4 and IPv6, including IPv4-mapped, 6to4 and NAT64 forms) to be globally routable, and connects to one of the validated addresses, using the same parsed host for the check and the connection. Remote requests made during HTML browser rendering are downloaded by the same loader, and the browser itself stays offline. When a proxy is configured through environment variables, requests go through the proxy, which is then responsible for filtering destinations.
Frequently Asked Questions
- What is CVE-2026-105743? CVE-2026-105743 is a medium-severity server-side request forgery (SSRF) vulnerability in docling (pip), affecting versions >= 2.91.0, < 2.132.0. It is fixed in 2.132.0. Untrusted input controls the target URL of a server-initiated request, which may reach internal services not otherwise accessible from outside.
- How severe is CVE-2026-105743? CVE-2026-105743 has a CVSS score of 4.0 (Medium). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.
- Which packages are affected by CVE-2026-105743?
docling(pip) (versions >= 2.91.0, < 2.132.0)docling-slim(pip) (versions >= 2.92.0, < 2.132.0)
- Is there a fix for CVE-2026-105743? Yes. CVE-2026-105743 is fixed in 2.132.0. Upgrade to this version or later.
- Is CVE-2026-105743 exploitable, and should I be worried? Whether CVE-2026-105743 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
- What actually determines whether CVE-2026-105743 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
- How do I fix CVE-2026-105743?
- Upgrade
doclingto 2.132.0 or later - Upgrade
docling-slimto 2.132.0 or later
- Upgrade