docling-serve: memory telemetry endpoints omit the auth dependency, exposing stats and forced GC

Impact

Two endpoints in docling-serve 1.14.0 through 1.36.0 are registered without the require_auth dependency, so DOCLING_SERVE_API_KEY does not protect them. An unauthenticated caller reads process and cgroup memory telemetry and object-type histograms, and can force repeated gc.collect() heap enumeration. The telemetry leaks the container's cgroup limits and working-set shape - useful reconnaissance against a document conversion service that sits in front of GPU-backed layout and OCR models - and the forced garbage collection is an unauthenticated way to burn CPU and stall request handling in the serving process. There is no code execution or document content disclosure here; the loss is confidentiality of runtime telemetry plus a cheap availability lever.

Who can reach it

Network, unauthenticated. Anyone who can reach the docling-serve HTTP port, which on most clusters means any tenant pod on the service network, since operators assume the API key gates the whole service.

What to do

Upgrade past 1.36.0 to a release that applies require_auth to the memory endpoints. In the meantime block /v1/memory/* at the ingress, service mesh or network policy in front of docling-serve - the endpoints are diagnostic and nothing in normal operation calls them. Either path is a container image bump and pod restart, or a routing rule change; no node drain or reboot.

References

Related entries

• TrustyAI Service Operator: unauthenticated access to AI guardrail and orchestrator APIsCVE-2026-15044 · TrustyAI Service Operator (Red Hat OpenShift AI)Medium
• llama.cpp: oversized seq_id in a saved slot file leaks heap memory past the cells arrayCVE-2026-43630 · llama.cpp server (recurrent memory state slot-restore path)Medium
• vLLM: race in the prompt_embeds sparse-tensor guard reopens the CVE-2025-62164 crash pathCVE-2026-73557 · vLLM prompt_embeds loader (safe_load_prompt_embeds sparse-tensor guard)Medium
• Eclipse Che dashboard backend (POST /dashboard/api/data/resolver): The dashboard backend passes a user-supplied URLCVE-2026-86590 · Eclipse Che dashboard backend (POST /dashboard/api/data/resolver)Medium
• vLLM: allowed_token_ids validated against tokenizer length, corrupting shared GPU logit-bias stateCVE-2026-93840 · vLLM (SamplingParams allowed_token_ids validation / LogitBiasState)Medium
• vLLM: unbounded prompt token ids write out of bounds in the penalty bincount Triton kernelCVE-2026-93841 · vLLM (Triton _bincount_kernel, penalty prompt-presence bitset)Medium