NLTK

NLTK XML parsing allows billion laughs DoS

Several XML parsing sites in NLTK still used xml.etree.ElementTree directly, which honours <!ENTITY> declarations in a document's internal DTD subset. A crafted document a few hundred bytes long can expand to megabytes in memory (each nesting level multiplies by ten), a denial-of-service.

Affected call sites (<= 3.10.2): - nltk.chunk.named_entity.load_ace_file, parses ACE annotation XML - nltk.internals.ElementWrapper, converts any given string to an Element - nltk.downloader, Package.fromxml, Collection.fromxml, _find_collections, _find_packages

libexpat 2.6.0 added an