CVE-2026-78681 — NLTK before 3.10.3 Entity Expansion DoS via ElementTree
NLTK versions before 3.10.3 use xml.etree.ElementTree to parse XML in multiple modules, which honors entity declarations in document DTDs. Attackers can craft XML payloads with …
Published: 2026-08-25 · CVSS: 8.7 · CVSS 4.0
NLTK versions before 3.10.3 use xml.etree.ElementTree to parse XML in multiple modules, which honors entity declarations in document DTDs. Attackers can craft XML payloads with nested entity declarations that expand from hundreds of bytes to megabytes in memory, causing denial of service.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7