CVE-2026-44020High· 7.5▾ TwilightDocling: Unsafe XML Entity Expansion in USPTO Patent Backend
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Aug 1.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
0.3%
0.3% → 0.6%
The USPTO patent XML parser used the standard xml.sax.parseString() without protection against XML External Entity (XXE) attacks. An attacker could craft malicious USPTO patent XML files with external entity references that could:
The vulnerability affects three USPTO patent format parsers: ICE (v4.x), Grant v2.5, and Application v1.x.
Fixed in version 2.74.0. The parser now uses defusedxml.sax.make_parser() with secure configuration that blocks external entity resolution (feature_external_ges=False, feature_external_pes=False) while allowing DTD declarations required by USPTO files. This prevents XXE attacks while maintaining compatibility with the USPTO XML format.
Avoid processing USPTO patent XML files from untrusted sources. Implement resource limits (memory, CPU time) when processing patent documents.
docling >= 2.13.0, < 2.74.0Upgrade to a patched release:
docling 2.74.0Connected by shared product, vendor, weakness, or advisory.
CVE-2026-105750Medium· 5.9Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem
CVE-2026-105751High· 7.5Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem
CVE-2026-105748Medium· 4.3Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem
CVE-2026-105749Medium· 6.5Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem
CVE-2026-105747Medium· 4.3Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem
CVE-2026-105742Low· 3.7Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem