Description
NLTK versions before 3.10.3 use xml.etree.ElementTree to parse XML in multiple modules, which honors entity declarations in document DTDs. Attackers can craft XML payloads with nested entity declarations that expand from hundreds of bytes to megabytes in memory, causing denial of service.
Published: 2026-08-25
Score: 8.7 High
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

No analysis available yet.

Remediation

No remediation available yet.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 25 Aug 2026 02:00:00 +0000

Type Values Removed Values Added
Description NLTK versions before 3.10.3 use xml.etree.ElementTree to parse XML in multiple modules, which honors entity declarations in document DTDs. Attackers can craft XML payloads with nested entity declarations that expand from hundreds of bytes to megabytes in memory, causing denial of service.
Title NLTK before 3.10.3 Entity Expansion DoS via ElementTree
First Time appeared Nltk
Nltk nltk
Weaknesses CWE-776
CPEs cpe:2.3:a:nltk:nltk:*:*:*:*:*:*:*:*
Vendors & Products Nltk
Nltk nltk
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Nltk Nltk
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-08-25T01:30:37.749Z

Reserved: 2026-08-25T01:17:12.263Z

Link: CVE-2026-78681

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-08-25T02:16:52.750

Modified: 2026-08-25T02:16:52.750

Link: CVE-2026-78681

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses
  • CWE-776

    Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')