CVE-2026-78681
HIGH
NVD
CVSS Score
7.5
Severity
HIGH
Published
Aug 25, 2026
Vendor
unknown
Description
NLTK versions before 3.10.3 use xml.etree.ElementTree to parse XML in multiple modules, which honors entity declarations in document DTDs. Attackers can craft XML payloads with nested entity declarations that expand from hundreds of bytes to megabytes in memory, causing denial of service.