CVE-2026-126299NLTK before 3.10.4 Quadratic-Time Denial of Service via CCG Lexicon fromstring

Açıklama

NLTK before 3.10.4 contains a denial of service vulnerability in the CCG lexicon parser fromstring that allows remote attackers to exhaust CPU by supplying wide inputs. Attackers can submit lexicon text with long flat bracket bodies or operator chains, triggering quadratic string re-slicing in matchBrackets and augParseCategory that blocks worker threads.

Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.

Etkilenen ürünler ve sürümler

Kaynaklar ve yamalar

• GitHub Security Advisory (GHSA-89p3-fcch-88ph) vendor-advisory
• VulnCheck Advisory: NLTK before 3.10.4 Quadratic-Time Denial of Service via CCG Lexicon fromstring third-party-advisory