High severity7.5NVD Advisory· Published Aug 25, 2026

CVE-2026-78681

Description

NLTK versions before 3.10.3 use xml.etree.ElementTree to parse XML in multiple modules, which honors entity declarations in document DTDs. Attackers can craft XML payloads with nested entity declarations that expand from hundreds of bytes to megabytes in memory, causing denial of service.

Affected products

Nltk/Nltkllm-fuzzy
Range: <3.10.3

Patches

Vulnerability mechanics

References

github.com/nltk/nltk/security/advisories/GHSA-97qj-x29f-37w7nvd
www.vulncheck.com/advisories/nltk-before-entity-expansion-dos-via-elementtreenvd

News mentions

No linked articles in our index yet.

cvss	0.488
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000