Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.3

NLTK <3.10.3 may crash from malicious XML

published 2 months ago
Summary

Versions of the NLTK library older than 3.10.3 read XML files in a way that lets specially crafted documents cause the program to use huge amounts of memory and stop working. This can be triggered by an attacker sending a malicious XML payload. Update NLTK to version 3.10.3 or later to protect against this issue.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
Ecosystem VendorProductAffected versions
PyPI nltk team nltk <= 3.10.2
Original advisory text
Duplicate Advisory: Entity-expansion DoS (billion laughs) via remaining raw ElementTree parses (CWE-776)
## Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-97qj-x29f-37w7. This link is maintained to preserve external references.

## Original Description

NLTK versions before 3.10.3 use xml.etree.ElementTree to parse XML in multiple modules, which honors entity declarations in document DTDs. Attackers can craft XML payloads with nested entity declarations that expand from hundreds of bytes to megabytes in memory, causing denial of service.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker partial control (estimated)
Severity
8.3 High
Type
CWE-776Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')
Timeline
Published25 Aug 2026
Updated2 Sep 2026
First seen2 Sep 2026
Sources
GHSA-jx89-3qg8-p2mr · OSV
Track software like this
Free during beta