—

PYSEC-2026-3748

Quick fix

PYSEC-2026-3748 — nltk: upgrade to the fixed version with the command below.

pip install --upgrade 'nltk>=3.10.3'

Details

NLTK versions before 3.10.3 use xml.etree.ElementTree to parse XML in multiple modules, which honors entity declarations in document DTDs. Attackers can craft XML payloads with nested entity declarations that expand from hundreds of bytes to megabytes in memory, causing denial of service.

Are you affected?

Enter the version of the package you're using.

Affected packages

PyPI/nltk

Introduced in: 0Fixed in: 3.10.3

Fixpip install --upgrade 'nltk>=3.10.3'

References

https://www.vulncheck.com/advisories/nltk-before-entity-expansion-dos-via-elementtree[ADVISORY]
https://github.com/nltk/nltk/security/advisories/GHSA-97qj-x29f-37w7[EVIDENCE]