NLTK versions prior to 3.10.3 are vulnerable to a denial-of-service attack via XML entity expansion, commonly known as a 'Billion Laughs' attack. The library uses Python's xml.etree.ElementTree to parse XML across multiple modules, which processes entity declarations defined in document DTDs. Attackers can craft malicious XML payloads containing deeply nested entity declarations that expand exponentially in memory, turning small payloads of hundreds of bytes into megabytes of data. This memory exhaustion can cause denial of service on affected systems. The fix is available in NLTK version 3.10.3. The vulnerability has been documented in the NLTK GitHub security advisories and VulnCheck advisories. Users are strongly advised to upgrade to the patched version immediately.
