Server-Side Request Forgery in Docling-Graph Affects Document Processing
CVE-2026-44520

5.7MEDIUM

Key Information:

Vendor

Docling-project

Status
Docling-graph
Vendor
CVE Published:
14 May 2026

What is CVE-2026-44520?

The Docling-Graph tool, designed to convert documents into validated Pydantic objects and create directed knowledge graphs, contains a vulnerability in its URLInputHandler class. Before version 1.5.1, this class inadequately handled HTTP requests made to user-supplied URLs by failing to validate whether these URLs resolved to private, loopback, or link-local IP addresses. The URLValidator only checked for a valid URL scheme and a non-empty netloc, omitting crucial IP-level validation. This oversight allowed attackers to exploit the requests.head() function—configured with allow_redirects=True—leading to potential redirection of requests to internal endpoints through intermediary URLs. Attackers can execute this by manipulating the --source CLI argument or the PipelineConfig.source API parameter. The vulnerability has been addressed in version 1.5.1.

Affected Version(s)

docling-graph < 1.5.1

References

https://github.com/docling-project/docling-graph/security...
x_refsource_CONFIRM

CVSS V3.1

Score:
5.7
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.