NLTK · CVE-2026-126298 · Package
NO FIX YET · SEE WHAT TO DO
NLTK before 3.10.4 has a quadratic-time slowdown in Tree.chomsky_normal_form, which uses list.pop(0) during binarization. A remote attacker who supplies a wide, flat treebank tree to Tree.fromstring can tie up a CPU core for tens of seconds and block the processing thread.
first public Oct 26, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Applications that use NLTK to parse treebank data from untrusted sources, such as user uploads or external feeds, are exposed to slow parsing that blocks the processing thread. Pipelines that only parse trusted, local treebank files are less exposed, and the fix is a version upgrade.
Not affected if nltk-not-installed, trusted-input-only
Who cares nlp, nltk, python
pip show nltk or python -c "import nltk; print(nltk.__version__)".Tree.fromstring or chomsky_normal_form on input from users or external sources.3.10.4 or later.NLTK before 3.10.4 contains a denial of service vulnerability in Tree.chomsky_normal_form that allows remote attackers to exhaust CPU through quadratic-time right-factor binarization using list.pop(0). Attackers can supply a wide flat treebank tree parsed by Tree.fromstring to force tens of seconds of single-threaded CPU consumption, blocking the processing thread.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.