Technical impact
NLTK versions earlier than 3.10.3 use the standard xml.etree.ElementTree parser to process XML documents, and this parser honors entity declarations in the document DTD. An attacker can craft a payload with deeply nested entity declarations that enlarge a small number of bytes into many megabytes, exhausting the memory allocated for parsing and causing a denial of service. This flaw is an example of improper handling of XML entity expansions (CWE‑776) that compromises availability for any application that uses the vulnerable library.
Affected Systems
The vulnerable product is the Python NLTK library distributed under the nltk namespace. All releases prior to 3.10.3, regardless of sub‑version, contain the affected XML parsing code and are therefore susceptible to exploitation in any environment where the library is imported or instantiated.
Risk and Exploitability
The CVSS score of 8.7 classifies this as a high‑severity vulnerability. EPSS information is not available, and the vulnerability is not listed in CISA KEV. The likely attack vector is that an attacker supplies a specially crafted XML document to any component that invokes NLTK’s XML parsing functions. Based on the description, it is inferred that a remote attacker could deliver the payload through an API endpoint or form that accepts XML input, whereas a local attacker could trigger the denial by executing a malicious script or feeding a crafted file to a command‑line tool that uses NLTK.
Github GHSA