DocAI Fabric | Security Advisories https://docaifabric.com/security/advisories/ Critical and High vulnerabilities fixed in DocAI Fabric, with the release that fixes them and what to do. en-us DAF-SA-2026-003 (High): Denial of service through the trace context header (OpenTelemetry) https://docaifabric.com/security/advisories/daf-sa-2026-003/ https://docaifabric.com/security/advisories/daf-sa-2026-003/ Tue, 27 Oct 2026 00:00:00 GMT High An unauthenticated request with a crafted tracestate header could stall the API and document processing for several seconds per request. Fixed in release 2026.10.24-1 (cloud) and image 2026.10.26-1 (self-hosted). DocAI Fabric cloud (US and Australia): Nothing. The fix is deployed. Self-hosted image: Update the image to 2026.10.26-1 or later. A deployment without APPLICATIONINSIGHTS_CONNECTION_STRING is not affected. CVE-2026-114603 DAF-SA-2026-002 (Critical): Out-of-bounds write in the Brotli decoder (Node.js and Python) https://docaifabric.com/security/advisories/daf-sa-2026-002/ https://docaifabric.com/security/advisories/daf-sa-2026-002/ Wed, 28 Oct 2026 00:00:00 GMT Critical A server reached by a business rule, a model endpoint or a connector could answer with a crafted compressed response that triggers an out-of-bounds write in the Brotli decoder. Fixed in release 2026.10.24-1 (cloud) and image 2026.10.26-1 (self-hosted). DocAI Fabric cloud (US and Australia): Nothing. The fix is deployed. Self-hosted image: Update the image to 2026.10.26-1 or later. CVE-2026-111497, CVE-2026-105483, CVE-2026-106069, CVE-2026-106072, CVE-2026-105481 DAF-SA-2026-001 (Critical): Memory-safety vulnerabilities in image decoding (Pillow) https://docaifabric.com/security/advisories/daf-sa-2026-001/ https://docaifabric.com/security/advisories/daf-sa-2026-001/ Tue, 27 Oct 2026 00:00:00 GMT Critical A crafted image uploaded or imported into a project could trigger memory-safety bugs in the image library DocAI Fabric uses to open page images. Fixed in release 2026.10.22-1. DocAI Fabric cloud (US and Australia): Nothing. The fix is deployed. Self-hosted image: Update the image to 2026.10.26-1 or later, which also fixes DAF-SA-2026-002 and DAF-SA-2026-003. CVE-2026-112403, CVE-2026-112395, CVE-2026-112404, CVE-2026-112897, CVE-2026-112896, CVE-2026-112397, CVE-2026-112895, CVE-2026-112400, CVE-2026-112899