1 matches found
GHSA-97QJ-X29F-37W7 NLTK: Entity-expansion DoS (billion laughs) via remaining raw ElementTree parses
Several XML parsing sites in NLTK still used xml.etree.ElementTree directly, which honours declarations in a document's internal DTD subset. A crafted document a few hundred bytes long can expand to megabytes in memory each nesting level multiplies by ten, a denial-of-service. Affected call sites...
8.7CVSS6AI score0.00521EPSS
SaveExploits1References7
20