CVE-2026-105742: docling-slim Remote Image Header Exposure Vulnerability
Summary
CVE-2026-105742: Docling: Configured HTTP headers sent to every remote image host named by a document. Affects docling-slim versions >= 2.95.0, < 2.132.0. Fixed in 2.132.0. How to fix ↓
Also tracked for
The same CVE-2026-105742 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
docling-slim is a lightweight library designed for converting HTML documents into various formats while supporting remote image fetching. It allows users to specify HTTP headers for authentication purposes when accessing remote images. However, this functionality can lead to security risks if not properly managed, particularly when handling untrusted documents.
Vulnerability Detail
The vulnerability arises from the way docling-slim handles HTTP headers when fetching remote images. Specifically, the library sends configured headers, such as API keys or bearer tokens, to any remote image host specified in the document without validating the origin of the request. This means that if an untrusted document references an image from an attacker-controlled URL, the caller's credentials could be exposed to the attacker. The issue is exacerbated by the fact that the library does not strip custom headers during cross-host redirects, leading to potential credential leakage.
How To Fix
Latest published version: 2.142.1 as of 23 Oct 2026
pip install --upgrade "docling-slim==2.142.1"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.132.0
This is the first release that contains the fix.
pip install --upgrade "docling-slim==2.132.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
For users unable to upgrade to the patched version, a temporary workaround is to avoid setting the 'headers' option when converting untrusted documents. Alternatively, use credentials that are valid only for the intended host and have no other value.
Conclusion
The docling-slim library has a vulnerability (CVE-2026-105742) that can expose sensitive HTTP headers when processing untrusted documents. Users are advised to upgrade to version 2.132.0 or later to mitigate this risk. For those unable to upgrade, specific workarounds can help reduce exposure.
See every vulnerability recorded for docling-slim →
FAQ
CVE-2026-105742 is a vulnerability in the docling-slim library that allows untrusted documents to expose configured HTTP headers, potentially leading to credential leakage.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The primary impact is the disclosure of sensitive request headers, such as API keys or authentication tokens, to an attacker-controlled host.
If upgrading is not possible, avoid using the 'headers' option with untrusted documents or use limited-scope credentials.
The CVSS score for this vulnerability is 3.7, indicating a moderate level of risk.
References
Related vulnerabilities
Recent vulnerabilities recorded for docling-slim.
