What’s Vulnerable › Vulnerabilities

CVE-2026-78681: NLTK before 3.10.3 Entity Expansion DoS via ElementTree

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2026-08-25 · updated 2026-10-12
• Weakness: CWE-776

Description

NLTK versions before 3.10.3 use xml.etree.ElementTree to parse XML in multiple modules, which honors entity declarations in document DTDs. Attackers can craft XML payloads with nested entity declarations that expand from hundreds of bytes to megabytes in memory, causing denial of service.

Affected products

• nltk: before 3.10.3 — fixed in 3.10.3

How to fix

Upgrade to a fixed version: nltk 3.10.3. Check the vendor advisory for mitigations.

References

• https://github.com/nltk/nltk/security/advisories/GHSA-97qj-x29f-37w7
• https://www.vulncheck.com/advisories/nltk-before-entity-expansion-dos-via-elementtree

Get alerted when CVE-2026-78681 or the next vulnerability affects your stack