PT-2026-110151 · Docling · Docling-Serve
CVSS v3.1
3.7
Low
| Vector | AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N |
docling-serve 1.14.0 through 1.36.0 contains a missing authentication vulnerability that allows unauthenticated attackers to access /v1/memory/stats and /v1/memory/counts because they omit the require auth dependency. Attackers can bypass the configured DOCLING SERVE API KEY to read process and cgroup memory telemetry, object type histograms, and force repeated gc.collect() heap enumeration.
Fix
Missing Authentication
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Docling-Serve