---
id: CVE-2026-78681
title: >-
  NLTK versions before 3.10.3 use xml.etree.ElementTree to parse XML in multiple
  modules, which honors entity declarations in document DTDs
summary: >-
  NLTK versions before 3.10.3 use xml.etree.ElementTree to parse XML in multiple
  modules, which honors entity declarations in document DTDs. Attackers can
  craft XML payloads with nested entity declarations that expand from hundreds
  of byte…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
cwe:
  - CWE-776
vendor: nltk
product: nltk
affected:
  - nltk < 3.10.3
patched:
  - nltk 3.10.3
published: '2026-08-25'
updated: '2026-10-12'
sourceUpdated: '2026-10-12T21:10:00.227'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-78681'
references:
  - url: 'https://github.com/nltk/nltk/security/advisories/GHSA-97qj-x29f-37w7'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/nltk-before-entity-expansion-dos-via-elementtree
    label: disclosure@vulncheck.com
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-78681'
  - url: >-
      https://github.com/nltk/nltk/commit/e91789c9a043296ad04912ce171c22776d45963b
  - url: 'https://github.com/nltk/nltk'
  - url: 'https://github.com/nltk/nltk/releases/tag/v3.10.3'
  - url: >-
      https://github.com/pypa/advisory-database/tree/main/vulns/nltk/PYSEC-2026-3748.yaml
  - url: 'https://github.com/advisories/GHSA-97qj-x29f-37w7'
tags:
  - nvd
  - osv
  - pip
  - ghsa
epss: 0.00521
epssPercentile: 0.44049
aliases:
  - GHSA-97qj-x29f-37w7
  - PYSEC-2026-3748
ecosystem: pip
ingestedAt: '2026-09-02T19:31:25.007Z'
---

## Overview

NLTK versions before 3.10.3 use xml.etree.ElementTree to parse XML in multiple modules, which honors entity declarations in document DTDs. Attackers can craft XML payloads with nested entity declarations that expand from hundreds of bytes to megabytes in memory, causing denial of service.

## Affected

- `nltk < 3.10.3`

## Remediation

Upgrade past the affected range:

- `nltk 3.10.3`

## Package advisory (CVE-2026-78681)

Affected packages:

- `nltk < 3.10.3`

Patched in:

- `nltk 3.10.3`

Source: https://osv.dev/vulnerability/GHSA-97qj-x29f-37w7