Missing Authentication Vulnerability in Docling-Serve by Docling
CVE-2026-108749

6.3MEDIUM

Key Information:

Vendor

Docling-project

Status
Docling-serve
Vendor
CVE Published:
11 October 2026

What is CVE-2026-108749?

The Docling-Serve application versions 1.14.0 through 1.36.0 contain a missing authentication vulnerability that enables unauthenticated attackers to gain access to sensitive memory statistics. The endpoints, specifically /v1/memory/stats and /v1/memory/counts, do not enforce the required authentication, leading to potential exposure of critical telemetry data such as process and cgroup memory metrics. This vulnerability may allow adversaries to bypass security configurations, including the DOCLING_SERVE_API_KEY, facilitating the unauthorized enumeration of memory usage patterns and object type distributions.

Affected Version(s)

docling-serve 1.14.0 <= 1.36.0

References

https://hackmd.io/@haind03/docling-serve-memory-endpoints...
third-party-advisory
https://github.com/docling-project/docling-serve/blob/07b...
technical-description
https://github.com/docling-project/docling-serve/blob/07b...
technical-description

CVSS V4

Score:
6.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

HaiND from the Post and Telecommunication Institute of Technology
.