CVE-2026-78681

HighCVSS 7.5/10Last modified Oct 12, 2026

Description

NLTK versions before 3.10.3 use xml.etree.ElementTree to parse XML in multiple modules, which honors entity declarations in document DTDs. Attackers can craft XML payloads with nested entity declarations that expand from hundreds of bytes to megabytes in memory, causing denial of service.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-776

Affected software

No affected versions have been published.

Timeline

Published
Aug 25, 2026
Last modified
Oct 12, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-786827.5NLTK before 3.10.3 contains a server-side request forgery vulnerability in nltk.pathsec.urlopen (and callers nltk.data.load, nltk.downloaderCVE-2026-786839.6NLTK before 3.10.0 (affected versions <=3.9.4) contains an unsafe pickle deserialization vulnerability in the TransitionParser.parse() methoCVE-2026-786845.3vLLM before 0.27.0 fails to properly classify DeepStream as a GPU backend and omits pixel-limit enforcement in its decode path. UnauthenticaCVE-2026-786858.8Medical Practice Management System developed by Le-yan has a Remote Code Execution vulnerability. Unauthenticated remote attackers can execuCVE-2026-786898.1Description NGINX JavaScript (njs) has a vulnerability in the XML module's namespace prefix list parser, reachable through the xml.exclusiCVE-2026-78695.4IBM Langflow OSS 1.0.0 through 1.10.3 is vulnerable to Path Traversal in the Knowledge Bases API (`POST /api/v1/knowledge_bases`). This occuCVE-2026-786912.1Improper Neutralization of Special Elements in Data Query Logic vulnerability in ash-project ash_sql allows a user who supplies a search terCVE-2026-786936.9Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash_graphql allows a remote client to read internaCVE-2026-786997.2Unchecked Return Value vulnerability in ash-project ash_postgres allows a user who can drive a tenant rename to a name that collides with anCVE-2026-78708.8IBM i 7.6, 7.5, 7.4, and 7.3 could allow a user to gain elevated privileges due to an unqualified library call. A malicious actor could causCVE-2026-787016.5A flaw was found in 389-ds-base. A remote, authenticated attacker could exploit a vulnerability in the Simple Authentication and Security LaCVE-2026-78719.8IBM Langflow OSS 1.0.0 through 1.10.0 allows users with Redis access to execute arbitrary code with full application privileges, compromisin