CVE-2026-78681

PYSEC-2026-3748 · CVE-2026-78681 · GHSA-97qj-x29f-37w7

Published Aug 25, 2026 · Modified Sep 2, 2026

AI SAST

Find this class of vulnerability in your own code

Corgea's AI-native static analysis detects vulnerabilities like this one across your repositories, ranks them by exploitability, and returns review-ready fixes.

Explore AI SAST Explore dependency scanning →

Description

NLTK versions before 3.10.3 use xml.etree.ElementTree to parse XML in multiple modules, which honors entity declarations in document DTDs. Attackers can craft XML payloads with nested entity declarations that expand from hundreds of bytes to megabytes in memory, causing denial of service.

References

ADVISORY https://www.vulncheck.com/advisories/nltk-before-entity-expansion-dos-via-elementtree
EVIDENCE https://github.com/nltk/nltk/security/advisories/GHSA-97qj-x29f-37w7

Ready to move

Start Securing

Start for Free Get Demo

Free, no credit card | First findings in minutes

CVE-2026-78681

Description

References

More PyPI vulnerabilities

Start Securing