CVE-2026-78681 json
NLTK before 3.10.3 Entity Expansion DoS via ElementTree
published 2026-08-25 2 mo ago modified 2026-10-12 27 d ago also GHSA-97qj-x29f-37w7 , PYSEC-2026-3748 , EUVD-2026-65227
- cvss
- 7.5
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.5%
- EPSS 0.5% chance of exploitation in 30 days, percentile 44%
- public exploits
- 0
- none known
Summary
NLTK versions before 3.10.3 use xml.etree.ElementTree to parse XML in multiple modules, which honors entity declarations in document DTDs. Attackers can craft XML payloads with nested entity declarations that expand from hundreds of bytes to megabytes in memory, causing denial of service.
Patch / fix
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 2 mo ago
Exploit prediction
0.52% chance of exploitation in the next 30 days, higher than 44% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- github.com https://github.com/nltk/nltk/security/advisories/GHSA-97qj-x29f-37w7 referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 8.7 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N |
| CNA | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| CNA | 4.0 | 8.7 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | nltk | <3.10.3 |
3.10.3 |
Affected products
- nltk nltk
Classification
- Weakness
-
- CWE-776 Improper Restriction of Recursive Entity References in DTDs
References
-
github.com
/nltk/nltk/commit/e91789c9a043296ad04912ce171c22776d45963b
web
-
github.com
/nltk/nltk/security/advisories/GHSA-97qj-x29f-37w7
vendor-advisory, web, exploit, evidence
-
vulncheck.com
/advisories/nltk-before-entity-expansion-dos-via-elementtree
third-party-advisory, web, advisory
-
nvd.nist.gov
/vuln/detail/CVE-2026-78681
advisory
-
github.com
/nltk/nltk
package
-
github.com
/nltk/nltk/releases/tag/v3.10.3
web
-
github.com
/pypa/advisory-database/tree/main/vulns/nltk/PYSEC-2026-3748.yaml
web
Sources
- CVE List CVE-2026-78681
- GitHub Advisory GHSA-97qj-x29f-37w7
- NVD CVE-2026-78681
- OSV PYSEC-2026-3748
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.