GHSA-f4ch-vxwc-3p2m

Suggest an improvement
Source
https://github.com/advisories/GHSA-f4ch-vxwc-3p2m
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-f4ch-vxwc-3p2m/GHSA-f4ch-vxwc-3p2m.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-f4ch-vxwc-3p2m
Withdrawn
2026-10-06T13:43:11Z
Published
2026-10-06T00:32:49Z
Modified
2026-10-06T14:00:05Z
Severity
  • 4.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L CVSS Calculator
Summary
Duplicate Advisory: Docling: METS-GBS archive member limit enforced after full member enumeration (memory exhaustion during format detection)
Details

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-3cr3-8m4c-fpxw. This link is maintained to preserve external references.

Original Description

Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.45.0 until 2.131.0, METS-GBS format detection in docling/datamodel/document.py and the backend in docling/backend/mets_gbs_backend.py call tarfile.TarFile.getmembers() before enforcing the max_member_count limit, causing the full archive member list to be allocated before the limit can stop processing. A small gzip-compressed tar archive with a very large number of empty members can therefore consume memory proportional to the declared member count, including during format detection before the allowed_formats restriction is applied. This issue is a residual weakness in the member-count protection added for CVE-2026-44018. This issue is fixed in 2.131.0.

Database specific 
{
    "cwe_ids": [
        "CWE-409"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-10-06T13:43:11Z",
    "nvd_published_at": "2026-10-05T22:16:57Z",
    "severity": "MODERATE"
}
References

Affected packages

PyPI / docling

Package

Name
docling
View open source insights on deps.dev
Purl
pkg:pypi/docling

Affected ranges

Type
ECOSYSTEM
Events
Introduced
2.45.0
Fixed
2.131.0

Affected versions

2.*
2.45.0
2.46.0
2.47.0
2.47.1
2.48.0
2.49.0
2.50.0
2.51.0
2.52.0
2.53.0
2.54.0
2.55.0
2.55.1
2.56.0
2.56.1
2.57.0
2.58.0
2.59.0
2.60.0
2.60.1
2.61.0
2.61.1
2.61.2
2.62.0
2.63.0
2.64.0
2.64.1
2.65.0
2.66.0
2.67.0
2.68.0
2.69.0
2.69.1
2.70.0
2.71.0
2.72.0
2.73.0
2.73.1
2.74.0
2.75.0
2.76.0
2.77.0
2.78.0
2.79.0
2.80.0
2.81.0
2.82.0
2.83.0
2.84.0
2.85.0
2.86.0
2.87.0
2.88.0
2.89.0
2.90.0
2.91.0
2.92.0
2.93.0
2.94.0
2.95.0
2.96.0
2.96.1
2.97.0
2.98.0
2.99.0
2.100.0
2.101.0
2.102.0
2.102.1
2.102.2
2.103.0
2.104.0
2.105.0
2.106.0
2.107.0
2.108.0
2.109.0
2.110.0
2.111.0
2.112.0
2.113.0
2.114.0
2.115.0
2.116.0
2.117.0
2.118.0
2.118.1
2.119.0
2.120.1
2.120.2
2.120.3
2.121.0
2.122.0
2.123.0
2.123.1
2.124.0
2.125.0
2.126.0
2.127.0
2.128.0
2.129.0
2.130.0

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-f4ch-vxwc-3p2m/GHSA-f4ch-vxwc-3p2m.json"