Vulnerability record · CVE-2026-105743 · published 5 October 2026

CVE-2026-105743: TOCTOU race condition vulnerability

Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.91.0 until 2.132.0, validate_url_safety in docling/backend/utils/image_resource_loader.py validates a hostname with a single IPv4 lookup and then allows the HTTP client to resolve and parse the original URL again, permitting DNS rebinding, mixed public and internal address records, and backslash authority parser disagreement to reach internal services. HTMLBackendOptions(render_page=True) also allows HTTP and HTTPS browser requests without validating their resolved destination. Exploitation requires remote fetching to be enabled, and response content is exposed only when it is decoded as an image or passively rendered in a page screenshot. This issue is fixed in 2.132.0.

4.0 CVSS 3.1 Medium CWE-367 · TOCTOU race conditionCWE-918 · Server-side request forgery (SSRF) Awaiting Analysis

4.0CVSS 3.1 base score

-EPSS exploitation probability, 30 days

NoNot in CISA KEV

0Affected product versions listed by NVD

4References

6 Oct 2026Last modified by NVD

Description

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N

References

Link	Tags
https://github.com/docling-project/docling/commit/5e469137f275ffc443306a30d12a3a45bceb80fb
https://github.com/docling-project/docling/pull/4420
https://github.com/docling-project/docling/releases/tag/v2.132.0
https://github.com/docling-project/docling/security/advisories/GHSA-pc36-qwjq-x68c

Track CVE-2026-105743 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

7.4CVE-2015-3246libuser userhelper direct /etc/passwd write race conditionlibuser before 0.56.13-8 and 0.60 before 0.60-7, as used by the userhelper program in the usermode package, modifies /etc/passwd directly instead of …KEVEPSS 8.4%analysed11 Aug 2015 7.8CVE-2025-38352Linux kernel POSIX CPU timer TOCTOU race enables local privilege escalationA time-of-check to time-of-use race exists in the Linux kernel between handle_posix_cpu_timers() and posix_cpu_timer_del(). When an exiting non-autor…KEVEPSS 1.3%analysed22 Jul 2025 8.2CVE-2025-22224VMware ESXi and Workstation TOCTOU race leads to out-of-bounds writeVMware ESXi, Workstation, and related products contain a TOCTOU race condition that results in an out-of-bounds write. An attacker with local adminis…KEVEPSS 1.6%analysed4 Mar 2025 7.0CVE-2024-30088Windows Kernel TOCTOU race condition privilege escalationCVE-2024-30088 is a time-of-check time-of-use (TOCTOU) race condition in the Windows kernel that allows a local user to elevate privileges. It affect…KEVEPSS 68%analysed11 Jun 2024 7.0CVE-2022-48618Apple OS Pointer Authentication Bypass via TOCTOU Race ConditionA time-of-check time-of-use race condition in Apple's pointer authentication implementation allows an attacker who already holds arbitrary read and w…KEVEPSS 0.49%analysed9 Jan 2024 8.8CVE-2023-35311Microsoft Outlook security feature bypass via TOCTOU race conditionCVE-2023-35311 is a security feature bypass in Microsoft Outlook caused by a time-of-check time-of-use (TOCTOU) race condition (CWE-367). It affects …KEVEPSS 16%analysed11 Jul 2023

Source: NIST National Vulnerability Database (record CVE-2026-105743), CISA KEV, FIRST EPSS. This page is refreshed as NVD updates the record.