{
  "cveId": "CVE-2026-78681",
  "url": "https://patchblox.com/security/cve/CVE-2026-78681",
  "summary": "CVE-2026-78681 is fixed in nltk on 1 platform by DEBIAN-CVE-2026-78681 (version 3.10.3-1), released August 26, 2026. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "nltk: NLTK versions before 3.10.3 use xml.etree.ElementTree to parse XML in multiple modules, which honors entity declarati...",
  "description": "NLTK versions before 3.10.3 use xml.etree.ElementTree to parse XML in multiple modules, which honors entity declarations in document DTDs. Attackers can craft XML payloads with nested entity declarations that expand from hundreds of bytes to megabytes in memory, causing denial of service.",
  "published": "2026-08-25T02:16:52Z",
  "severity": "",
  "epss": 0.00521,
  "epssPercentile": 0.44507,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "nltk",
      "release": "Debian 14",
      "fixedVersion": "3.10.3-1",
      "fix": "DEBIAN-CVE-2026-78681",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-78681",
      "released": "2026-08-26T00:17:14Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-09T01:18:40Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}