Vulnerability Description
NLTK versions before 3.10.3 use xml.etree.ElementTree to parse XML in multiple modules, which honors entity declarations in document DTDs. Attackers can craft XML payloads with nested entity declarations that expand from hundreds of bytes to megabytes in memory, causing denial of service.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Nltk | Nltk | < 3.10.3 |
Related Weaknesses (CWE)
References
- https://github.com/nltk/nltk/security/advisories/GHSA-97qj-x29f-37w7ExploitVendor Advisory
- https://www.vulncheck.com/advisories/nltk-before-entity-expansion-dos-via-elemenThird Party Advisory
FAQ
What is CVE-2026-78681?
CVE-2026-78681 is a vulnerability with a CVSS score of 7.5 (HIGH). NLTK versions before 3.10.3 use xml.etree.ElementTree to parse XML in multiple modules, which honors entity declarations in document DTDs. Attackers can craft XML payloads with nested entity declarati...
How severe is CVE-2026-78681?
CVE-2026-78681 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-78681?
Check the references section above for vendor advisories and patch information. Affected products include: Nltk Nltk.