CVE-2026-44520
- Source
- https://cve.org/CVERecord?id=CVE-2026-44520
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-44520.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-44520
- Aliases
- Published
- 2026-05-14T16:56:58.110Z
- Modified
- 2026-07-08T08:05:14.783824267Z
- Severity
-
- 5.7 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N CVSS Calculator
- Summary
- Docling-Graph: SSRF via Missing Internal IP Validation in URLInputHandler
- Details
-
Docling-Graph turns documents into validated Pydantic objects, then builds a directed knowledge graph with explicit semantic relationships. Prior to 1.5.1, the URLInputHandler class in doclinggraph/core/input/handlers.py makes HTTP requests to user-supplied URLs without validating whether the target resolves to a private, loopback, or link-local IP address. The URLValidator only checks for a valid scheme and non-empty netloc, performing no IP-level validation. Additionally, requests.head() was called with allowredirects=True, allowing an attacker to redirect requests to internal endpoints via an intermediary URL. An attacker who can control the --source CLI argument or PipelineConfig.source API parameter can trigger Server-Side Request Forgery (SSRF). This vulnerability is fixed in 1.5.1.
- Database specific
{ "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/44xxx/CVE-2026-44520.json", "cna_assigner": "GitHub_M", "cwe_ids": [ "CWE-601", "CWE-918" ] }- References