7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-44020

CVE-2026-44020: Docling: Unsafe XML Entity Expansion in USPTO Patent Backend

Impact

The USPTO patent XML parser used the standard xml.sax.parseString() without protection against XML External Entity (XXE) attacks. An attacker could craft malicious USPTO patent XML files with external entity references that could:

Read arbitrary files from the server filesystem
Perform Server-Side Request Forgery (SSRF) attacks
Cause denial of service through entity expansion (Billion Laughs attack)

The vulnerability affects three USPTO patent format parsers: ICE (v4.x), Grant v2.5, and Application v1.x.

Patches

Fixed in version 2.74.0. The parser now uses defusedxml.sax.make_parser() with secure configuration that blocks external entity resolution (feature_external_ges=False, feature_external_pes=False) while allowing DTD declarations required by USPTO files. This prevents XXE attacks while maintaining compatibility with the USPTO XML format.

Workarounds

Avoid processing USPTO patent XML files from untrusted sources. Implement resource limits (memory, CPU time) when processing patent documents.

References

Fix release: v2.74.0

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-44020

CVE-2026-44020:

7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
docling	pip	>= 2.13.0, < 2.74.0	2.74.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The security vulnerability is an XML External Entity (XXE) injection weakness in the docling library. The root cause is the use of insecure default XML parsers in multiple backends. The advisory specifically calls out the USPTO patent backend, which uses xml.sax.parseString across three different classes (PatentUsptoIce, PatentUsptoGrantV25, PatentUsptoApplicationV1x) in their respective parse methods. This function processes external XML entities, which allows an attacker to read arbitrary files from the server, initiate server-side requests (SSRF), or trigger denial-of-service attacks.

The analysis of the patch commit 576bada7b7d542ea308778a053bc3c4d49086f20 confirms this. The commit replaces the vulnerable xml.sax.parseString calls with defusedxml.sax.make_parser, a library designed to prevent such attacks. The parser is explicitly configured to disable external entity resolution while still allowing the DTDs required by the USPTO format.

Furthermore, the same commit also patched a similar XXE vulnerability in the JATS backend (JatsDocumentBackend.__init__), where lxml.etree.parse was used without a secure parser. The fix was to instantiate etree.XMLParser with resolve_entities=False. Although not mentioned in the advisory's title, this function is also considered vulnerable and was patched simultaneously, indicating it is part of the same security effort.

Vulnerable functions

PatentUsptoIce.parse

docling/backend/xml/uspto_backend.py

The function uses the insecure `xml.sax.parseString` method to parse XML content. This method is vulnerable to XML External Entity (XXE) attacks as it processes external entities by default. An attacker could provide a specially crafted XML file to read local files, perform server-side request forgery (SSRF), or cause a denial of service.

PatentUsptoGrantV25.parse

docling/backend/xml/uspto_backend.py

This function is vulnerable to XXE attacks because it uses `xml.sax.parseString` to process USPTO patent data in Grant v2.5 format. The parser resolves external entities, allowing an attacker to exploit the vulnerability by submitting a malicious XML document.

PatentUsptoApplicationV1x.parse

docling/backend/xml/uspto_backend.py

The function parses USPTO patent application XML (v1.x) using `xml.sax.parseString`, which is unsafe by default. This allows for XML External Entity (XXE) attacks, as the parser will attempt to resolve external entities defined in the input XML.

JatsDocumentBackend.__init__

docling/backend/xml/jats_backend.py

The constructor for the JATS backend uses `etree.parse` without a secure parser configuration. By default, `etree.parse` can resolve external entities, making the application vulnerable to XXE attacks when parsing JATS XML files. The fix was included in the same commit as the USPTO fixes.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.