p PatchFirst

CVE-2026-78681

CVE-2026-78681 · NLTK before 3.10.3 Entity Expansion DoS via ElementTree

This page contains facts from public vulnerability sources. Check the original advisory before updating.

NLTK versions before 3.10.3 use xml.etree.ElementTree to parse XML in multiple modules, which honors entity declarations in document DTDs. Attackers can craft XML payloads with nested entity declarations that expand from hundreds of bytes to megabytes in memory, causing denial of service.

CVSS 8.7 · High · EPSS 0.5% · Fix available

Published
Updated

Stack: system · python

Affected products and versions

  • nltk

    Versions
    • ≥ 0, < 3.10.3: Affected (semver)
    • 3.10.3: Not affected (semver)

    Update to 3.10.3

  • nltk Debian:12

    Versions
    • 3.10.0-1
    • 3.10.1-1
    • 3.10.3-1
    • 3.8-1
    • 3.8.1-1
    • 3.9.1-1
    • 3.9.1-2
    • 3.9.2-1
    • 3.9.3-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • nltk Debian:13

    Versions
    • 3.10.0-1
    • 3.10.1-1
    • 3.10.3-1
    • 3.9.1-2
    • 3.9.2-1
    • 3.9.3-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • nltk Debian:14

    Versions
    • 3.10.0-1
    • 3.10.1-1
    • 3.9.1-2
    • 3.9.2-1
    • 3.9.3-1
    Affected ranges
    • ECOSYSTEM: < 3.10.3-1

    Update to 3.10.3-1

  • nltk PyPI

    Versions
    • 0.8
    • 0.9
    • 0.9.3
    • 0.9.4
    • 0.9.5
    • 0.9.6
    • 0.9.7
    • 0.9.8
    • 0.9.9
    • 2.0.1
    • 2.0.1rc1
    • 2.0.1rc2-git
    • 2.0.1rc3
    • 2.0.1rc4
    • 2.0.2
    • 2.0.3
    • 2.0.4
    • 2.0.5
    • 2.0b4
    • 2.0b5
    • 2.0b6
    • 2.0b7
    • 2.0b8
    • 2.0b9
    • 3.0.0
    • 3.0.0b1
    • 3.0.0b2
    • 3.0.1
    • 3.0.2
    • 3.0.3
    • 3.0.4
    • 3.0.5
    • 3.1
    • 3.10.0
    • 3.10.1
    • 3.10.2
    • 3.2
    • 3.2.1
    • 3.2.2
    • 3.2.3
    • 3.2.4
    • 3.2.5
    • 3.3
    • 3.4
    • 3.4.1
    • 3.4.2
    • 3.4.3
    • 3.4.4
    • 3.4.5
    • 3.5
    • 3.5b1
    • 3.6
    • 3.6.1
    • 3.6.2
    • 3.6.3
    • 3.6.4
    • 3.6.5
    • 3.6.6
    • 3.6.7
    • 3.7
    • 3.8
    • 3.8.1
    • 3.9
    • 3.9.1
    • 3.9.2
    • 3.9.3
    • 3.9.4
    • 3.9b1
    Affected ranges
    • ECOSYSTEM: < 3.10.3

    Update to 3.10.3

Original sources

Check your server →