CVE-2026-126303NLTK before 3.10.4 Denial of Service via SteppingRecursiveDescentParser.parse()

Descripción

NLTK before 3.10.4 contains an uncontrolled resource consumption vulnerability in SteppingRecursiveDescentParser.parse() that lacks any max_time deadline or step limit. Attackers influencing the grammar can supply an ambiguous self-embedding grammar and short token input to force unbounded top-down search, pinning CPU cores and exhausting worker pools.

Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.

Productos y versiones afectados

Referencias y parches

• GitHub Security Advisory (GHSA-8fx7-8jr8-84rv) vendor-advisory
• VulnCheck Advisory: NLTK before 3.10.4 Denial of Service via SteppingRecursiveDescentParser.parse() third-party-advisory