CVE-2026-126299 · Package
NO FIX YET · SEE WHAT TO DO
NLTK's CCG lexicon parser fromstring takes quadratic time on long bracket bodies or operator chains in lexicon text. A remote attacker who supplies such input can exhaust CPU and block worker threads, causing denial of service.
first public Oct 26, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Applications that pass lexicon text from untrusted sources into NLTK's CCG lexicon parser fromstring are exposed to CPU exhaustion. Projects that only parse their own trusted lexicon files, or that do not use the CCG module, can skip it.
Not affected if ccg-unused, trusted-input-only
Who cares nlp, nltk, python
python -c "import nltk; print(nltk.__version__)"nltk.ccg lexicon fromstring) that handle untrusted input3.10.4 (fixed version stated for NLTK before 3.10.4)NLTK before 3.10.4 contains a denial of service vulnerability in the CCG lexicon parser fromstring that allows remote attackers to exhaust CPU by supplying wide inputs. Attackers can submit lexicon text with long flat bracket bodies or operator chains, triggering quadratic string re-slicing in matchBrackets and augParseCategory that blocks worker threads.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.