Entity Expansion Denial of Service Vulnerability in NLTK by NLTK Project

CVE-2026-78681

What is CVE-2026-78681?

The NLTK library, specifically versions prior to 3.10.3, utilizes the xml.etree.ElementTree module for XML parsing. This implementation inadvertently allows attackers to exploit entity declarations within document DTDs. By crafting malicious XML payloads that contain nested entity declarations, an attacker can cause significant memory consumption, leading to a denial of service condition. Organizations using NLTK must update to version 3.10.3 or later to mitigate this risk.

References