CVE-2026-126303NLTK before 3.10.4 Denial of Service via SteppingRecursiveDescentParser.parse()

Beschreibung

NLTK before 3.10.4 contains an uncontrolled resource consumption vulnerability in SteppingRecursiveDescentParser.parse() that lacks any max_time deadline or step limit. Attackers influencing the grammar can supply an ambiguous self-embedding grammar and short token input to force unbounded top-down search, pinning CPU cores and exhausting worker pools.

Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.

Betroffene Produkte und Versionen

Referenzen und Patches

• GitHub Security Advisory (GHSA-8fx7-8jr8-84rv) vendor-advisory
• VulnCheck Advisory: NLTK before 3.10.4 Denial of Service via SteppingRecursiveDescentParser.parse() third-party-advisory