CVE-2026-78681
NLTK versions before 3.10.3 use xml.etree.ElementTree to parse XML in multiple modules, which honors entity declarations in document DTDs. Attackers can craft XML payloads with nested entity declarations that expand from hundreds of bytes to megabytes in memory, causing denial of service.
- Affected products
- Nltk
- Fix
- Available
- CVSS 4.0
- 8.7 HIGH
- CVSS 3.1
- 7.5 HIGH
- EPSS
- 0.3% (20th percentile)
- Weakness
- CWE-776
- NVD status
- Received
- Published
- 2026-08-25
CVE-2026-78681 at NVD
No indexed exploits for CVE-2026-78681 yet
Our index is partial: it proves presence, never absence
No exploit for CVE-2026-78681 has been indexed yet. Our index is built from live traffic and upstream syncs, so this page can only say what it knows — not that no exploit exists.