This site currently shows sample data for demonstration.
BDVDB
বাংলা

Vulnerabilities

CVE-2026-78681 | BDVDB-2026-364488 Detail

nltknltk

Description#

NLTK versions before 3.10.3 use xml.etree.ElementTree to parse XML in multiple modules, which honors entity declarations in document DTDs. Attackers can craft XML payloads with nested entity declarations that expand from hundreds of bytes to megabytes in memory, causing denial of service.

Impact#

Per CVSS v3.1: confidentiality impact none, integrity impact none, availability impact high. Attack vector: network.

Weaknesses#

  • CWE-776 Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')

References#

Exploit#

No public exploit known

History#

  1. Version 1Record published in the CVE List.
  2. Version 2Most recent update recorded in the CVE List.