XML Entity Expansion DoS in NLTK

Executive Summary

CVE-2026-78681 is an entity-expansion denial-of-service (DoS) vulnerability in NLTK versions before 3.10.3. It occurs because NLTK uses xml.etree.ElementTree to parse XML, which honors entity declarations in document DTDs. Attackers can craft XML payloads with nested entity declarations that expand exponentially in memory, consuming resources and causing a DoS.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if your system uses NLTK versions before 3.10.3. Run: pip show nltk or pip list | grep nltk. If the version is below 3.10.3, the system is vulnerable. Additionally, monitor for unusual memory consumption during XML parsing operations.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact you by allowing attackers to send crafted XML payloads that consume excessive memory, leading to system slowdowns or crashes. If your application processes XML using NLTK, it may become unresponsive or fail due to resource exhaustion.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability primarily causes denial-of-service conditions by consuming excessive memory through XML entity expansion. It does not directly lead to data breaches or unauthorized access, so its impact on compliance like GDPR or HIPAA is likely minimal unless service disruption affects data availability or processing.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade NLTK to version 3.10.3 or later immediately. Use pip install --upgrade nltk. If upgrading is not possible, implement input validation for XML files and disable entity expansion in XML parsers. Consider using the new nltk.xmlsec module for secure XML parsing.

Useful 0 Not Useful 0