Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.8

NLTK library can crash on overly nested input

published 2 months ago
Summary

The Natural Language Toolkit (NLTK) version before 3.10.3 may stop working if it receives data with many layers of brackets. This can cause the program to crash, potentially disrupting services that use NLTK to read user-provided text patterns. Update NLTK to version 3.10.3 or later to prevent the crash.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
Ecosystem VendorProductAffected versions
PyPI nltk team nltk <= 3.10.2
Original advisory text
Duplicate Advisory: Uncontrolled recursion in nltk.featstruct.FeatStructReader causes unhandled RecursionError (DoS) via deeply nested feature-structure input
## Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-cw6x-m8jw-qmrh. This link is maintained to preserve external references.

## Original Description
NLTK before 3.10.3 contains an uncontrolled recursion vulnerability in nltk.featstruct.FeatStructReader that allows unauthenticated attackers to cause a denial of service by supplying deeply nested feature-structure input. Attackers can craft trivial payloads with nested brackets that exceed Python's recursion limit and raise an unhandled RecursionError, crashing applications that parse user-supplied feature structures or feature grammars.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker partial control (estimated)
Severity
7.8 High
Type
CWE-674Uncontrolled Recursion
Timeline
Published27 Aug 2026
Updated2 Sep 2026
First seen2 Sep 2026
Sources
GHSA-pf76-q698-37v8 · OSV
Track software like this
Free during beta