CVE-2026-78681 HIGH

CVE-2026-78681: NLTK before 3.10.3 Entity Expansion DoS via ElementTree

Vendor Nltk

Product nltk

Weakness CWE-776

Published August 25, 2026

Last update August 25, 2026

View on NVD All CVEs

CVSS base score

8.7/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction None

Confidentiality —

Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

What the vulnerability does

01Description

NLTK versions before 3.10.3 use xml.etree.ElementTree to parse XML in multiple modules, which honors entity declarations in document DTDs. Attackers can craft XML payloads with nested entity declarations that expand from hundreds of bytes to megabytes in memory, causing denial of service.

Key dates

02Disclosure timeline

August 25, 2026 CVE published

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-78681 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/776.html AskarLabs — CWE-776 write-up Improper Restriction of Recursive Entity References in DTDs (XML Entity Expansion)