CVE-2026-78681 in NLTK
要約
〜によって MITRE • 2026年08月25日
NLTK versions before 3.10.3 use xml.etree.ElementTree to parse XML in multiple modules, which honors entity declarations in document DTDs. Attackers can craft XML payloads with nested entity declarations that expand from hundreds of bytes to megabytes in memory, causing denial of service.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.