CVE-2026-126300 · Package
NO FIX YET · SEE WHAT TO DO
NLTK's TreebankWordTokenizer.span_tokenize runs in quadratic time because it repeatedly calls list.pop(0) on long runs of double-quote characters. An attacker who submits such text to a service that span-tokenizes untrusted input can use up a CPU core and degrade availability.
first public Oct 26, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Applications that pass untrusted user text to NLTK's TreebankWordTokenizer.span_tokenize are exposed, since a crafted input can stall a CPU core. Batch jobs and services that only tokenize trusted internal text can skip it.
Not affected if no-span-tokenize, trusted-input-only
Who cares nlp, nltk, python
pip show nltk or python -c "import nltk; print(nltk.__version__)".span_tokenize calls on user-supplied text, such as TreebankWordTokenizer.3.10.4 or later.NLTK from 3.2.5 before 3.10.4 contains an algorithmic complexity vulnerability in TreebankWordTokenizer.span_tokenize that allows remote attackers to cause quadratic CPU consumption through repeated list.pop(0) calls. Attackers can submit long runs of double-quote characters to services span-tokenizing untrusted text, exhausting a CPU core and degrading availability.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.