CVE-2026-126297 · Package
NO FIX YET · SEE WHAT TO DO
NLTK before 3.10.4 has a quadratic-time flaw in ConllCorpusReader._get_srl_instances that re-scans spans in nested loops. A crafted CoNLL SRL corpus with many predicates and span columns can exhaust CPU and pin a core for minutes.
first public Oct 26, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Applications that use NLTK's ConllCorpusReader to parse CoNLL SRL corpus files, especially where those files can come from untrusted users or remote sources. Projects that only read their own trusted corpora or do not use this reader are unlikely to be exposed.
Not affected if no-untrusted-corpus-input, reader-not-used
Who cares nltk, python
pip show nltk or python -c "import nltk; print(nltk.__version__)"3.10.4 or later (per the NVD description: before 3.10.4 is affected)NLTK before 3.10.4 contains a quadratic-time denial of service vulnerability in ConllCorpusReader._get_srl_instances that allows remote attackers to exhaust CPU through nested span rescans. Attackers can supply a crafted CoNLL SRL corpus with many predicates and span columns, placing the head span last, to pin a core for minutes.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.