CVE-2026-126297NLTK before 3.10.4 CPU Denial of Service via ConllCorpusReader srl_instances

Beschreibung

NLTK before 3.10.4 contains a quadratic-time denial of service vulnerability in ConllCorpusReader._get_srl_instances that allows remote attackers to exhaust CPU through nested span rescans. Attackers can supply a crafted CoNLL SRL corpus with many predicates and span columns, placing the head span last, to pin a core for minutes.

Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.

Betroffene Produkte und Versionen

Referenzen und Patches

• GitHub Security Advisory (GHSA-v8f3-6phw-6mh9) vendor-advisory
• VulnCheck Advisory: NLTK before 3.10.4 CPU Denial of Service via ConllCorpusReader srl_instances third-party-advisory