{"id":"CVE-2026-126297","kind":"vulnerability","aliases":["CVE-2026-126297"],"related":[],"title":"NLTK: crafted CoNLL corpus file pins CPU for minutes","description":"NLTK before 3.10.4 contains a quadratic-time denial of service vulnerability in ConllCorpusReader._get_srl_instances that allows remote attackers to exhaust CPU through nested span rescans. Attackers can supply a crafted CoNLL SRL corpus with many predicates and span columns, placing the head span last, to pin a core for minutes.","summary":"NLTK before 3.10.4 has a quadratic-time flaw in ConllCorpusReader._get_srl_instances that re-scans spans in nested loops. A crafted CoNLL SRL corpus with many predicates and span columns can exhaust CPU and pin a core for minutes.","severity":"high","cvss":8.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["nltk","package","python"],"not_affected_if":["no-untrusted-corpus-input","reader-not-used"],"how_to_check":"- Check the installed NLTK version with `pip show nltk` or `python -c \"import nltk; print(nltk.__version__)\"`\n- Look for code that calls ConllCorpusReader on corpus files that come from outside the team","fix":"- NLTK: `3.10.4` or later (per the NVD description: before 3.10.4 is affected)","status":"open","published_at":"2026-11-13T10:17:34+00:00","first_seen_at":"2026-11-13T10:47:14+00:00","triaged_at":"2026-11-13T10:50:31+00:00","updated_at":"2026-11-13T10:50:31+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-13T10:50:31Z","model":"claude-haiku-5-5","output":{"fix":"- NLTK: `3.10.4` or later (per the NVD description: before 3.10.4 is affected)","reach":"unknown","title":"NLTK: crafted CoNLL corpus file pins CPU for minutes","impact":"low","summary":"NLTK before 3.10.4 has a quadratic-time flaw in ConllCorpusReader._get_srl_instances that re-scans spans in nested loops. A crafted CoNLL SRL corpus with many predicates and span columns can exhaust CPU and pin a core for minutes.","audience":"developers","category":"package","nicknames":[],"who_cares":["python","nltk"],"confidence":0.6,"fix_status":"available","needs_auth":"unknown","worst_case":"Service slowdown or hang from CPU exhaustion on a single core","analyst_note":"","how_to_check":"- Check the installed NLTK version with `pip show nltk` or `python -c \"import nltk; print(nltk.__version__)\"`\n- Look for code that calls ConllCorpusReader on corpus files that come from outside the team","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["no-untrusted-corpus-input","reader-not-used"],"who_is_affected":"Applications that use NLTK's ConllCorpusReader to parse CoNLL SRL corpus files, especially where those files can come from untrusted users or remote sources. Projects that only read their own trusted corpora or do not use this reader are unlikely to be exposed.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000738,"input_tokens":4624,"output_tokens":552,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-126297':12A,15A '-2026':11A,14A '3.10.4':21B,60C 'allow':73C 'attack':75C,83C 'column':48B,96C 'conll':3A,40B,88C 'conllcorpusreader._get_srl_instances':29B,71C 'contain':61C 'core':55B,105C 'corpus':4A,42B,90C 'cpu':7A,51B,78C 'craft':2A,39B,87C 'cve':10A,13A 'denial':66C 'exhaust':50B,77C 'file':5A 'flaw':27B 'head':99C 'last':101C 'loop':37B 'mani':44B,92C 'minut':9A,57B,107C 'nest':36B,80C 'nltk':1A,16B,19B,58C 'packag':17B 'pin':6A,53B,103C 'place':97C 'predic':45B,93C 'python':18B 'quadrat':25B,64C 'quadratic-tim':24B,63C 're':32B 're-scan':31B 'remot':74C 'rescan':82C 'scan':33B 'servic':68C 'span':34B,47B,81C,95C,100C 'srl':41B,89C 'suppli':85C 'time':26B,65C 'vulner':69C","nicknames":[],"mitigations":[],"who_affected":"Applications that use NLTK's ConllCorpusReader to parse CoNLL SRL corpus files, especially where those files can come from untrusted users or remote sources. Projects that only read their own trusted corpora or do not use this reader are unlikely to be exposed.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","nltk","package","python"],"campaign_type":null,"search_a":"'-126297':12A,15A '-2026':11A,14A 'conll':3A 'corpus':4A 'cpu':7A 'craft':2A 'cve':10A,13A 'file':5A 'minut':9A 'nltk':1A 'pin':6A","search_b":"'3.10.4':21B 'column':48B 'conll':40B 'conllcorpusreader._get_srl_instances':29B 'core':55B 'corpus':42B 'cpu':51B 'craft':39B 'exhaust':50B 'flaw':27B 'loop':37B 'mani':44B 'minut':57B 'nest':36B 'nltk':16B,19B 'packag':17B 'pin':53B 'predic':45B 'python':18B 'quadrat':25B 'quadratic-tim':24B 're':32B 're-scan':31B 'scan':33B 'span':34B,47B 'srl':41B 'time':26B","search_c":"'3.10.4':60C 'allow':73C 'attack':75C,83C 'column':96C 'conll':88C 'conllcorpusreader._get_srl_instances':71C 'contain':61C 'core':105C 'corpus':90C 'cpu':78C 'craft':87C 'denial':66C 'exhaust':77C 'head':99C 'last':101C 'mani':92C 'minut':107C 'nest':80C 'nltk':58C 'pin':103C 'place':97C 'predic':93C 'quadrat':64C 'quadratic-tim':63C 'remot':74C 'rescan':82C 'servic':68C 'span':81C,95C,100C 'srl':89C 'suppli':85C 'time':65C 'vulner':69C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-26T09:50:18+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126297","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126297","severity":null,"published_at":"2026-11-13T10:17:34+00:00","modified_at":"2026-11-13T10:17:34+00:00","first_seen_at":"2026-11-13T10:47:14+00:00","fetched_at":"2026-11-13T10:47:14+00:00","note":null}],"documents":[{"id":144923,"url":"https://github.com/nltk/nltk/security/advisories/GHSA-v8f3-6phw-6mh9","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-26T09:50:18+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":144924,"url":"https://www.vulncheck.com/advisories/nltk-before-3.10.4-cpu-denial-of-service-via-conllcorpusreader-srl-instances","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}