MEDIUM 6.3 NVD
CVE-2026-108749
docling-serve 1.14.0 through 1.36.0 contains a missing authentication vulnerability that allows unauthenticated attackers to access /v1/memory/stats and /v1/mem
docling-serve 1.14.0 through 1.36.0 contains a missing authentication vulnerability that allows unauthenticated attackers to access /v1/memory/stats and /v1/memory/counts because they omit the require_auth dependency. Attackers can bypass the configured DOCLING_SERVE_API_KEY to read process and cgroup memory telemetry, object type histograms, and force repeated gc.collect() heap enumeration.
References
- https://github.com/docling-project/docling-serve
- https://github.com/docling-project/docling-serve/blob/07b1d3d3b515afd9196148e0353d54ea38de
- https://github.com/docling-project/docling-serve/blob/07b1d3d3b515afd9196148e0353d54ea38de
- https://hackmd.io/@haind03/docling-serve-memory-endpoints-api-key-bypass
- https://www.vulncheck.com/advisories/docling-serve-1.14.0-through-1.36.0-missing-authentic
This medium severity vulnerability with a CVSS score of 6.3 was published on 2026-10-11 via NVD.
vulnfeed aggregates 13827 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.