CVE-2026-78681
High · 7.5CVSS
7.5
EPSS
0.5%
Published
Aug 25, 2026
CISA due date
—
The record
NLTK versions before 3.10.3 use xml.etree.ElementTree to parse XML in multiple modules, which honors entity declarations in document DTDs. Attackers can craft XML payloads with nested entity declarations that expand from hundreds of bytes to megabytes in memory, causing denial of service.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-44018 Docling simplifies document processing by parsing diverse formats and providing… CWE-776
- CVE-2026-12993 A flaw was found in Apicurio Registry. CWE-776
- CVE-2026-44020 Docling simplifies document processing by parsing diverse formats and providing… CWE-776
- CVE-2026-45771 FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from… CWE-776
- GHSA-5qf9-cf9c-hjc6 Routinator crashes when encountering maliciously crafted RRDP XML files CWE-776
- CVE-2026-45304 Symfony's YAML Parser Vulnerable to Exponential Memory Allocation via Recursive… CWE-776
- CVE-2026-45133 Symfony hardened the parser when handling untrusted input CWE-776
- CVE-2026-23822 A vulnerability in the XML handling component of AOS-8 DHCP services could allow an… CWE-776