{"uuid": "0f7cde0f-9e29-4de3-8df6-ffb47f58eec2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108749", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117422408995215554", "content": "CVE-2026-108749 docling-serve 1.14.0 through 1.36.0 Missing Authentication via Memory Management Endpoints docling-serve 1.14.0 through 1.36.0 contains a missing authentication vulnerability that allows unauthenticated attackers to access /v1/memory/stats and /v1/memory/counts because they omit the require_auth dependency. Attackers can bypass the configured DOCLING_SERVE_API_KEY to read process and cgroup memory telemetry, object type histograms, and force repeated gc.collect() heap enumeration.\nhttps://www.cve.org/CVERecord?id=CVE-2026-108749https://hackmd.io/@haind03/docling-serve-memory-endpoints-api-key-bypasshttps://github.com/docling-project/docling-serve/blob/07b1d3d3b515afd9196148e0353d54ea38de2a37/docling_serve/app.py#L1631-L1687https://github.com/docling-project/docling-serve/blob/07b1d3d3b515afd9196148e0353d54ea38de2a37/docling_serve/auth.py#L49-L55https://github.com/docling-project/docling-servehttps://www.vulncheck.com/advisories/docling-serve-1.14.0-through-1.36.0-missing-authentication-via-memory-management-endpoints#docling-project #docling-serve#CVE_2026_108749#bot", "creation_timestamp": "2026-10-11T13:02:50.555496Z"}