CVE-2026-78681: NLTK before 3.10.3 Entity Expansion DoS via ElementTree
NLTK versions before 3.10.3 use xml.etree.ElementTree to parse XML in multiple modules, which honors entity declarations in document DTDs. Attackers can craft XML payloads with nested entity declarations that expand from hundreds of bytes to megabytes in memory, causing denial of service.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
NLTKto a version that resolves this vulnerability.Fixed in 3.10.3
Event History
Frequently Asked Questions
Who is exposed to this denial-of-service issue?
Applications using NLTK versions earlier than 3.10.3 are exposed when they parse attacker-controlled XML through affected NLTK modules. The vulnerability is remotely reachable and requires no attacker privileges or user interaction.
What does an attacker need to exploit it?
An attacker needs to supply a crafted XML document containing a DTD with nested entity declarations. Element expansion can grow a small input into megabytes of in-memory data, causing a denial of service.
Is confidentiality or data integrity affected?
The provided severity vector indicates impact to availability only. It does not indicate confidentiality or integrity impact.
What is the available remediation?
Upgrade NLTK to version 3.10.3 or later. The affected range is NLTK versions before 3.10.3.