Docling JATS XML Backend XML Entity Expansion Vulnerability Allowing Denial-of-Service

A vulnerability allowing XML Entity Expansion (XXE) attacks has been identified in Docling's JATS XML backend, affecting versions through 2.61.0. The issue arises because the backend uses etree.parse() to process XML files without disabling entity resolution. This oversight allows an attacker to create a malicious XML file with a nested entity expansion payload, known as an XML Bomb. When Docling processes this file, the exponential growth of entities leads to excessive resource consumption, causing a denial-of-service (DoS) condition on the system running the Docling parser.

Impact

Exploitation of this vulnerability leads to a denial-of-service condition, causing excessive resource consumption on the affected system.