Executive brief
NLTK is a widely-used Python library for natural language processing that includes XML parsing capabilities. A flaw in how it handles XML documents allows attackers to send specially crafted XML payloads that consume excessive memory when parsed, crashing applications that use NLTK. An attacker can exploit this remotely without authentication by submitting a small XML file that expands to consume megabytes of memory, disrupting service availability.
Technical details
The vulnerability is an XML Entity Expansion attack (CWE-776, "billion laughs") affecting multiple NLTK call sites that use xml.etree.ElementTree directly: nltk.chunk.named_entity.load_ace_file, nltk.internals.ElementWrapper, nltk.downloader (Package.fromxml, Collection.fromxml), and related functions. The root cause is that ElementTree honors entity declarations in DTD subsets without restriction. Attackers craft payloads with nested entity declarations where each nesting level multiplies output by approximately 10 while adding minimal input bytes—a payload of ~330 bytes can expand to 1 MB in memory. External entities are not resolved so this is memory-amplification DoS rather than XXE file disclosure. Attack vector is network-based with no authentication or user interaction required. The fix routes all affected parsing sites through a new nltk.xmlsec module that refuses entity declarations, using defusedxml with a fallback to xml.parsers.expat pre-scan. Patched in version 3.10.3.
Affected products
- NLTK Project NLTK < 3.10.3
Timeline
- 2026-08-11: disclosed: Original advisory GHSA-97qj-x29f-37w7 published
- 2026-08-25: advisory: Duplicate advisory GHSA-jx89-3qg8-p2mr published and later withdrawn
- 2026: patched: Fix available in version 3.10.3