Docling CVE-2026-105743: document processing can reach internal services

CVE-2026-105743, published on October 5, describes a destination-check bypass in Docling. Repeated DNS resolution and differences in URL interpretation can direct resource fetching towards internal services. Response disclosure is limited to content decoded as an image or visible in a screenshot of a rendered page.

Breachroad recommends reviewing document conversion in your workplace AI or RAG pipeline today. Identify the parser version, document sources and the process’s ability to make network connections. An assessment of the language model alone does not establish what the infrastructure preparing its inputs can do.

Which configurations need attention

The project advisory covers Docling from 2.91.0 to before 2.132.0, and docling-slim from 2.92.0 to before 2.132.0. The scenario requires enable_remote_fetch=True with image fetching or HTML rendering. The default enable_remote_fetch=False configuration is unaffected by this scenario. The fixed version of both packages is 2.132.0.

Our proposal for the application owner is to record the configuration of the process actually running, rather than rely on library defaults. Check whether application code, a processing profile or an integration changes conversion options. A client-supplied document may follow a different path from materials maintained in your own repository.

The inventory should connect the component to a service, owner and process account. For each processing path, establish whether an employee can provide an arbitrary file or select external material. Finding the package is a starting point; the assessment also needs to establish which inputs reach it and under whose authority those inputs are accepted.

Patch the parser and control its connections

Release 2.132.0, available since October 1, includes a change validating every resolved address and restricting fetch headers to the source origin. Connect your update to the image or package actually deployed in the service.

Breachroad recommends mapping the parser’s permitted network connections. If conversion does not require network access, leave remote fetching disabled. If it does, the infrastructure team should agree on allowed destinations and separate the process from services it does not need. Assess proxy configuration as well: the application’s outbound path should be known and controlled.

A dependency update and network restrictions serve different purposes. The update addresses the reported bug, while network controls reduce the resources the process can reach. Give any update exception an owner, deadline and reason. A network rule added to a document does not demonstrate that the deployed service is enforcing it.

Verify behaviour with a safe example

We suggest a compatibility check using a synthetic document that references an external resource owned by your organisation. Confirm that the update preserves the expected conversion and that network restrictions enforce the agreed policy. Check whether rejected connections are logged and can be linked to the task that attempted them.

This does not require requests to someone else’s infrastructure or real client data. The aim is evidence that the deployed version and controls match the team’s decision. Keep the result alongside the image identifier, date and person responsible for verification so that another team member can assess what was checked.

A scenario for an AI team briefing

Imagine a portal accepting documents for a workplace knowledge base. In this illustrative scenario, an administrator discovers that one conversion profile fetches illustrations from the internet. They update the parser, agree on allowed connections and document who can change that profile. Employees receive a clear procedure for reporting material whose conversion has been stopped.

This is Breachroad’s proposed process, rather than a reported incident. Our RAG security guide provides wider context. Through cybersecurity and secure AI training for organisations, teams can practise assessing document sources, setting integration boundaries and assigning responsibilities to users, developers and administrators.