{"id":"CVE-2026-126298","kind":"vulnerability","aliases":["CVE-2026-126298"],"related":[],"title":"NLTK: treebank parsing lets remote input exhaust CPU and stall processing","description":"NLTK before 3.10.4 contains a denial of service vulnerability in Tree.chomsky_normal_form that allows remote attackers to exhaust CPU through quadratic-time right-factor binarization using list.pop(0). Attackers can supply a wide flat treebank tree parsed by Tree.fromstring to force tens of seconds of single-threaded CPU consumption, blocking the processing thread.","summary":"NLTK before 3.10.4 has a quadratic-time slowdown in Tree.chomsky_normal_form, which uses list.pop(0) during binarization. A remote attacker who supplies a wide, flat treebank tree to Tree.fromstring can tie up a CPU core for tens of seconds and block the processing thread.","severity":"high","cvss":8.7,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"nltk","fixed":[],"affected":"","ecosystem":"pypi"}],"ecosystems":["pypi"],"tags":["nlp","nltk","package","python"],"not_affected_if":["nltk-not-installed","trusted-input-only"],"how_to_check":"- Check the installed NLTK version with `pip show nltk` or `python -c \"import nltk; print(nltk.__version__)\"`.\n- Look for code that calls `Tree.fromstring` or `chomsky_normal_form` on input from users or external sources.","fix":"- NLTK: upgrade to `3.10.4` or later.","status":"open","published_at":"2026-11-13T10:17:34+00:00","first_seen_at":"2026-11-13T10:47:14+00:00","triaged_at":"2026-11-13T10:50:34+00:00","updated_at":"2026-11-13T10:50:34+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-13T10:50:34Z","model":"claude-haiku-5-5","output":{"fix":"- NLTK: upgrade to `3.10.4` or later.","reach":"unknown","title":"NLTK: treebank parsing lets remote input exhaust CPU and stall processing","impact":"low","summary":"NLTK before 3.10.4 has a quadratic-time slowdown in Tree.chomsky_normal_form, which uses list.pop(0) during binarization. A remote attacker who supplies a wide, flat treebank tree to Tree.fromstring can tie up a CPU core for tens of seconds and block the processing thread.","audience":"developers","category":"package","nicknames":[],"who_cares":["nltk","python","nlp"],"confidence":0.8,"fix_status":"available","needs_auth":"no","worst_case":"Single-threaded CPU exhaustion stalls the parsing thread for tens of seconds","analyst_note":"","how_to_check":"- Check the installed NLTK version with `pip show nltk` or `python -c \"import nltk; print(nltk.__version__)\"`.\n- Look for code that calls `Tree.fromstring` or `chomsky_normal_form` on input from users or external sources.","plain_action":"","product_name":"nltk","needs_analyst":false,"not_affected_if":["trusted-input-only","nltk-not-installed"],"who_is_affected":"Applications that use NLTK to parse treebank data from untrusted sources, such as user uploads or external feeds, are exposed to slow parsing that blocks the processing thread. Pipelines that only parse trusted, local treebank files are less exposed, and the fix is a version upgrade.","user_interaction":"no","product_ecosystem":"pypi","needs_special_setup":"no","severity_if_unknown":"unknown"},"cost_usd":0.001066,"input_tokens":4633,"output_tokens":1205,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-126298':14A,17A '-2026':13A,16A '0':39B,99C '3.10.4':25B,71C 'allow':83C 'attack':44B,85C,100C 'binar':41B,96C 'block':65B,122C 'consumpt':121C 'contain':72C 'core':59B 'cpu':8A,58B,88C,120C 'cve':12A,15A 'denial':74C 'exhaust':7A,87C 'factor':95C 'flat':49B,105C 'forc':112C 'form':35B,81C 'input':6A 'let':4A 'list.pop':38B,98C 'nlp':19B 'nltk':1A,18A,20B,23B,69C 'normal':34B,80C 'packag':21B 'pars':3A,108C 'process':11A,67B,124C 'python':22B 'quadrat':29B,91C 'quadratic-tim':28B,90C 'remot':5A,43B,84C 'right':94C 'right-factor':93C 'second':63B,115C 'servic':76C 'singl':118C 'single-thread':117C 'slowdown':31B 'stall':10A 'suppli':46B,102C 'ten':61B,113C 'thread':68B,119C,125C 'tie':55B 'time':30B,92C 'tree':51B,107C 'tree.chomsky':33B,79C 'tree.fromstring':53B,110C 'treebank':2A,50B,106C 'use':37B,97C 'vulner':77C 'wide':48B,104C","nicknames":[],"mitigations":[],"who_affected":"Applications that use NLTK to parse treebank data from untrusted sources, such as user uploads or external feeds, are exposed to slow parsing that blocks the processing thread. Pipelines that only parse trusted, local treebank files are less exposed, and the fix is a version upgrade.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":["nltk"],"ptokens":["nltk"],"labels":["high","nlp","nltk","package","pypi","python"],"campaign_type":null,"search_a":"'-126298':14A,17A '-2026':13A,16A 'cpu':8A 'cve':12A,15A 'exhaust':7A 'input':6A 'let':4A 'nltk':1A,18A 'pars':3A 'process':11A 'remot':5A 'stall':10A 'treebank':2A","search_b":"'0':39B '3.10.4':25B 'attack':44B 'binar':41B 'block':65B 'core':59B 'cpu':58B 'flat':49B 'form':35B 'list.pop':38B 'nlp':19B 'nltk':20B,23B 'normal':34B 'packag':21B 'process':67B 'python':22B 'quadrat':29B 'quadratic-tim':28B 'remot':43B 'second':63B 'slowdown':31B 'suppli':46B 'ten':61B 'thread':68B 'tie':55B 'time':30B 'tree':51B 'tree.chomsky':33B 'tree.fromstring':53B 'treebank':50B 'use':37B 'wide':48B","search_c":"'0':99C '3.10.4':71C 'allow':83C 'attack':85C,100C 'binar':96C 'block':122C 'consumpt':121C 'contain':72C 'cpu':88C,120C 'denial':74C 'exhaust':87C 'factor':95C 'flat':105C 'forc':112C 'form':81C 'list.pop':98C 'nltk':69C 'normal':80C 'pars':108C 'process':124C 'quadrat':91C 'quadratic-tim':90C 'remot':84C 'right':94C 'right-factor':93C 'second':115C 'servic':76C 'singl':118C 'single-thread':117C 'suppli':102C 'ten':113C 'thread':119C,125C 'time':92C 'tree':107C 'tree.chomsky':79C 'tree.fromstring':110C 'treebank':106C 'use':97C 'vulner':77C 'wide':104C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-26T09:52:25+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126298","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126298","severity":null,"published_at":"2026-11-13T10:17:34+00:00","modified_at":"2026-11-13T10:17:34+00:00","first_seen_at":"2026-11-13T10:47:14+00:00","fetched_at":"2026-11-13T10:47:14+00:00","note":null}],"documents":[{"id":144925,"url":"https://github.com/nltk/nltk/security/advisories/GHSA-r53h-rw34-8h97","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-26T09:52:25+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":144926,"url":"https://www.vulncheck.com/advisories/nltk-before-3.10.4-quadratic-cpu-denial-of-service-via-tree-chomsky-normal-form","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}