Description

docling-serve 1.14.0 through 1.36.0 contains a missing authentication vulnerability that allows unauthenticated attackers to access /v1/memory/stats and /v1/memory/counts because they omit the require_auth dependency. Attackers can bypass the configured DOCLING_SERVE_API_KEY to read process and cgroup memory telemetry, object type histograms, and force repeated gc.collect() heap enumeration.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.7",
  "pubDate": "2026-10-11T13:17:19.670Z",
  "pubdate": "2026-10-11T13:17:19.670Z",
  "executiveSummary": "A critical missing authentication vulnerability exists in docling-serve versions 1.14.0 through 1.36.0, allowing unauthenticated remote attackers to interact with sensitive administrative endpoints.\nThe vulnerability stems from the omission of the 'require_auth' dependency on specific API routes, specifically '/v1/memory/stats' and '/v1/memory/counts'.\nBy bypassing the established DOCLING_SERVE_API_KEY security mechanism, unauthorized actors can query internal process memory telemetry, cgroup-level resource data, and object type histograms.\nFurthermore, the vulnerability permits the triggering of garbage collection routines, specifically 'gc.collect()', which forces heap enumeration.\nThis exposure presents significant risks, including information disclosure regarding server internals, potential performance degradation via forced memory management routines, and reconnaissance opportunities for further exploitation.\nThere are no specific privilege requirements for exploitation, as the missing dependency effectively places these diagnostic routes in an unauthenticated state, accessible to any network-reachable adversary.",
  "technicalDetails": "The root cause of this vulnerability is a design oversight in the routing layer of docling-serve versions 1.14.0 through 1.36.0, where the 'require_auth' middleware dependency was explicitly omitted for the '/v1/memory/stats' and '/v1/memory/counts' endpoints.\nIn a secure configuration, the application expects the 'DOCLING_SERVE_API_KEY' to be provided in the request headers; however, the lack of middleware enforcement allows requests to bypass the authentication gate entirely.\nThe attack flow is straightforward: an attacker sends a standard HTTP GET request to the vulnerable endpoints. Because the backend fails to validate credentials for these specific routes, the application processes the request and returns the serialized response containing sensitive telemetry data.\nThe exposure of '/v1/memory/stats' and '/v1/memory/counts' provides the attacker with granular insights into the application's runtime environment, including cgroup resource limits and current heap usage. The ability to invoke 'gc.collect()' is particularly concerning, as it allows an external actor to force the Python interpreter into heap enumeration cycles.\nRepeated or timed execution of 'gc.collect()' can be leveraged as a side-channel or a rudimentary Denial of Service (DoS) vector by inducing latency and increased CPU utilization during heavy memory pressure scenarios.\nThe vulnerability is limited to the defined endpoints, but the information leaked provides a detailed map of the application's internal state. This facilitates sophisticated reconnaissance, as attackers can observe memory patterns and object counts to deduce the nature of documents being processed or identify memory-resident data structures.\nThe vulnerability exists within the application's request handling pipeline, specifically where the FastAPI or similar routing decorator fails to inject the authentication dependency. Since the application fails to perform an authorization check, the security policy defined by the DOCLING_SERVE_API_KEY environment variable is effectively neutralized for the affected endpoints.\nPost-exploitation impact includes the potential for continuous monitoring of server load and document processing metrics, which may reveal sensitive operational intelligence. The forced garbage collection also disrupts normal operational stability by altering the deterministic performance of the service."
}