CVE-2026-126301 · Package
NO FIX YET · SEE WHAT TO DO
NLTK's LegalitySyllableTokenizer.tokenize runs a quadratic onset reversal loop on long all-vowel tokens. A remote attacker who supplies such a token can exhaust CPU and deny service to syllabification code.
first public Oct 26, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Applications that pass untrusted text into NLTK's LegalitySyllableTokenizer are exposed to CPU exhaustion from crafted long tokens. Batch jobs run on trusted corpora and code that never calls this tokenizer can skip it.
Not affected if tokenizer-unused, trusted-input-only
Who cares nltk, python
pip show nltkLegalitySyllableTokenizer in your code that take untrusted input3.10.4 or later (from the product range: fixed before 3.10.4)NLTK from 3.6 before 3.10.4 contains an algorithmic complexity vulnerability in LegalitySyllableTokenizer.tokenize that allows remote attackers to exhaust CPU by supplying long all-vowel tokens. Attackers can submit a token such as a long run of vowels, causing the unguarded onset reversal loop to perform quadratic work and deny service to syllabification components.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.