Bug 2549241 (CVE-2026-108749) - CVE-2026-108749 docling-serve: docling-serve: Information disclosure via missing authentication on memory endpoints
Summary: CVE-2026-108749 docling-serve: docling-serve: Information disclosure via miss...
Keywords:
Status: NEW
Alias: CVE-2026-108749
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-10-11 12:42 UTC by OSIDB Bzimport
Modified: 2026-10-11 12:51 UTC (History)
0 users

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description OSIDB Bzimport 2026-10-11 12:42:48 UTC 
docling-serve 1.14.0 through 1.36.0 contains a missing authentication vulnerability that allows unauthenticated attackers to access /v1/memory/stats and /v1/memory/counts because they omit the require_auth dependency. Attackers can bypass the configured DOCLING_SERVE_API_KEY to read process and cgroup memory telemetry, object type histograms, and force repeated gc.collect() heap enumeration.
Note You need to log in before you can comment on or make changes to this bug.