Security Advisories

One advisory per Critical or High vulnerability that reached a release, published once the fix is available on the cloud service and as a self-hosted image. Lower-severity fixes ship in regular releases without an advisory.

Unsubscribe from any of them at any time, from any email. No spam.

Prefer a feed? RSS or JSON. To report a vulnerability, see Responsible Disclosure.

  • High DAF-SA-2026-003

    Denial of service through the trace context header (OpenTelemetry)

    An unauthenticated request with a crafted tracestate header could stall the API and document processing for several seconds per request. Fixed in release 2026.10.24-1 (cloud) and image 2026.10.26-1 (self-hosted).

    CVE-2026-114603

  • Critical DAF-SA-2026-002

    Out-of-bounds write in the Brotli decoder (Node.js and Python)

    A server reached by a business rule, a model endpoint or a connector could answer with a crafted compressed response that triggers an out-of-bounds write in the Brotli decoder. Fixed in release 2026.10.24-1 (cloud) and image 2026.10.26-1 (self-hosted).

    CVE-2026-111497, CVE-2026-105483, CVE-2026-106069, CVE-2026-106072, CVE-2026-105481

  • Critical DAF-SA-2026-001

    Memory-safety vulnerabilities in image decoding (Pillow)

    A crafted image uploaded or imported into a project could trigger memory-safety bugs in the image library DocAI Fabric uses to open page images. Fixed in release 2026.10.22-1.

    CVE-2026-112403, CVE-2026-112395, CVE-2026-112404, CVE-2026-112897, CVE-2026-112896, CVE-2026-112397, CVE-2026-112895, CVE-2026-112400, CVE-2026-112899