What is CVE-2026-78681?

CVE-2026-78681 is a high-severity vulnerability in Nltk, classified under Improper Restriction of Recursive Entity References in DTDs (XML Entity Expansion). CVSS score: 7.5/10. Published 2026-08-25.

How severe is CVE-2026-78681?

High severity. CVSS v3 base score is 7.5 out of 10.

XXE in Nltk

CVE-2026-78681

NLTK versions before 3.10.3 use xml.etree.ElementTree to parse XML in multiple modules, which honors entity declarations in document DTDs. Attackers can craft XML payloads with nested entity declarations that expand from hundreds of bytes to megabytes in memory, causing denial of service.

EPSS: 0.003 (19.8th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.

Affected products

Nltk

Weakness classification (CWE)

CWE-776 — Improper Restriction of Recursive Entity References in DTDs (XML Entity Expansion)

References

disclosure@vulncheck.com (vendor-advisory)
disclosure@vulncheck.com (third-party-advisory)

Frequently asked questions

What is CVE-2026-78681?: CVE-2026-78681 is a high-severity vulnerability in Nltk, classified under Improper Restriction of Recursive Entity References in DTDs (XML Entity Expansion). CVSS score: 7.5/10. Published 2026-08-25.
How severe is CVE-2026-78681?: High severity. CVSS v3 base score is 7.5 out of 10.