{"metadata": {"vulnerability": "CVE-2026-105743", "count": 17, "kinds": {"milestone": 6, "sighting": 1, "kev": 0, "other": 10}}, "data": [{"timestamp": "2026-10-05T19:11:07.946Z", "date_only": false, "value": "2026-10-05T19:11:07.946Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-105743", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-05T21:23:45.527Z", "date_only": false, "value": "2026-10-05T21:23:45.527Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-105743", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-10-05T21:23:45.527Z", "date_only": false, "value": "2026-10-05T21:23:45.527Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / GitHub_M", "record": "CVE-2026-105743", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-05T22:16:57Z", "date_only": false, "value": "2026-10-05T22:16:57Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-PC36-QWJQ-X68C", "record": "GHSA-PC36-QWJQ-X68C", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-10-05T22:16:57.030Z", "date_only": false, "value": "2026-10-05T22:16:57.030", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-105743", "record": "FKIE_CVE-2026-105743", "field": "published"}, {"timestamp": "2026-10-05T22:16:57.030Z", "date_only": false, "value": "2026-10-05T22:16:57.030Z", "kind": "milestone", "label": "Published", "source": "pysec \u00b7 PYSEC-2026-4190", "record": "PYSEC-2026-4190", "field": "published"}, {"timestamp": "2026-10-07T20:42:19Z", "date_only": false, "value": "2026-10-07T20:42:19Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-PC36-QWJQ-X68C", "record": "GHSA-PC36-QWJQ-X68C", "field": "published"}, {"timestamp": "2026-10-07T20:42:19Z", "date_only": false, "value": "2026-10-07T20:42:19Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-PC36-QWJQ-X68C", "record": "GHSA-PC36-QWJQ-X68C", "field": "modified"}, {"timestamp": "2026-10-08T02:28:00.752Z", "date_only": false, "value": "2026-10-08T02:28:00.752216Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-105743", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-10-08T02:28:00.752Z", "date_only": false, "value": "2026-10-08T02:28:00.752216Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-105743", "record": "FKIE_CVE-2026-105743", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-10-08T02:28:12.458Z", "date_only": false, "value": "2026-10-08T02:28:12.458Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-105743", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-08T02:28:12.458Z", "date_only": false, "value": "2026-10-08T02:28:12.458Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-105743", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-08T03:16:34.960Z", "date_only": false, "value": "2026-10-08T03:16:34.960", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-105743", "record": "FKIE_CVE-2026-105743", "field": "lastModified"}, {"timestamp": "2026-10-08T06:30:31Z", "date_only": false, "value": "2026-10-08T06:30:31.000000Z", "kind": "sighting", "label": "Seen", "source": "https://gist.github.com/alon710/a0a3af962e14549395b72cb6cb429ad0", "record": "CVE-2026-105743", "field": "creation_timestamp", "uuid": "6f10ae7a-495e-44c9-b1a1-fec2fd6cbff1", "content": "# CVE-2026-105743: CVE-2026-105743: Server-Side Request Forgery Guard Bypass in Docling Document Conversion Engine\n\n> **CVSS Score:** 4.0\n> **Published:** 2026-10-07\n> **Full Report:** https://cvereports.com/reports/CVE-2026-105743\n\n## Summary\nAn SSRF guard bypass vulnerability in the Docling document conversion engine allows unauthenticated attackers to bypass internal IP access controls. The vulnerability exists due to a DNS rebinding Time-of-Check Time-of-Use (TOCTOU) condition, URL authority parsing inconsistencies, and unvalidated network requests triggered during headless browser page rendering.\n\n## TL;DR\nUnauthenticated Server-Side Request Forgery (SSRF) bypass in Docling via DNS Rebinding, URL parsing inconsistencies, and Playwright subresource fetching, allowing internal resource scanning and AWS metadata exfiltration.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **Vulnerability ID**: CVE-2026-105743\n- **CWE ID**: CWE-918 (Server-Side Request Forgery), CWE-367 (TOCTOU)\n- **CVSS Base Score**: 4.0 (Medium)\n- **Attack Vector**: Network (AV:N)\n- **Attack Complexity**: High (AC:H)\n- **Exploit Status**: Proof of Concept (PoC)\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- docling\n- docling-slim\n- **docling**: >= 2.91.0, < 2.132.0 (Fixed in: `2.132.0`)\n- **docling-slim**: >= 2.91.0, < 2.132.0 (Fixed in: `2.132.0`)\n\n## Mitigation\n\n- Upgrade Docling dependency to version 2.132.0 or higher.\n- Disable remote resource fetching if external page resources do not require parsing.\n- Isolate the application's network access using runtime container firewalls or network security groups.\n\n**Remediation Steps:**\n1. Step 1: Execute the dependency upgrade command: `pip install --upgrade docling docling-slim`.\n2. Step 2: Validate the upgrade within the local Python runtime environment: `python -c \"import docling; print(docling.__version__)\"` (Verify version >= 2.132.0).\n3. Step 3: Modify backend instantiation configurations to keep `enable_remote_fetch=False` unless specifically required.\n4. Step 4: Block outbound connections to local networks and cloud metadata ranges (such as `169.254.169.254`) by applying network isolation policies (e.g., using iptables, Kubernetes NetworkPolicies, or AWS Security Groups).\n\n## References\n\n- [Docling Security Advisory - GHSA-pc36-qwjq-x68c](https://github.com/docling-project/docling/security/advisories/GHSA-pc36-qwjq-x68c)\n- [Official Patch Commit](https://github.com/docling-project/docling/commit/5e469137f275ffc443306a30d12a3a45bceb80fb)\n- [Official Pull Request #4420](https://github.com/docling-project/docling/pull/4420)\n- [Release Notes Tag v2.132.0](https://github.com/docling-project/docling/releases/tag/v2.132.0)\n- [National Vulnerability Database Link](https://nvd.nist.gov/vuln/detail/CVE-2026-105743)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-105743) - Automated Vulnerability Intelligence*", "url": "https://gist.github.com/alon710/a0a3af962e14549395b72cb6cb429ad0"}, {"timestamp": "2026-10-08T09:43:12.289Z", "date_only": false, "value": "2026-10-08T09:43:12.289524Z", "kind": "other", "label": "Updated", "source": "pysec \u00b7 PYSEC-2026-4190", "record": "PYSEC-2026-4190", "field": "modified"}, {"timestamp": "2026-10-15T10:22:49.407Z", "date_only": false, "value": "2026-10-15T10:22:49.407289Z", "kind": "milestone", "label": "Published", "source": "pysec \u00b7 PYSEC-2026-4214", "record": "PYSEC-2026-4214", "field": "published"}, {"timestamp": "2026-10-15T14:37:39.907Z", "date_only": false, "value": "2026-10-15T14:37:39.907974Z", "kind": "other", "label": "Updated", "source": "pysec \u00b7 PYSEC-2026-4214", "record": "PYSEC-2026-4214", "field": "modified"}]}