{"id":"CVE-2026-126301","kind":"vulnerability","aliases":["CVE-2026-126301"],"related":[],"title":"NLTK: long vowel tokens cause CPU exhaustion in syllable tokenizer","description":"NLTK from 3.6 before 3.10.4 contains an algorithmic complexity vulnerability in LegalitySyllableTokenizer.tokenize that allows remote attackers to exhaust CPU by supplying long all-vowel tokens. Attackers can submit a token such as a long run of vowels, causing the unguarded onset reversal loop to perform quadratic work and deny service to syllabification components.","summary":"NLTK's LegalitySyllableTokenizer.tokenize runs a quadratic onset reversal loop on long all-vowel tokens. A remote attacker who supplies such a token can exhaust CPU and deny service to syllabification code.","severity":"medium","cvss":6.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["nltk","package","python"],"not_affected_if":["tokenizer-unused","trusted-input-only"],"how_to_check":"- Check the installed NLTK version with `pip show nltk`\n- Look for calls to `LegalitySyllableTokenizer` in your code that take untrusted input","fix":"- NLTK: move to `3.10.4` or later (from the product range: fixed before 3.10.4)","status":"open","published_at":"2026-11-13T10:17:35+00:00","first_seen_at":"2026-11-13T10:47:14+00:00","triaged_at":"2026-11-13T10:54:47+00:00","updated_at":"2026-11-13T10:54:47+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-13T10:54:47Z","model":"claude-haiku-5-5","output":{"fix":"- NLTK: move to `3.10.4` or later (from the product range: fixed before 3.10.4)","reach":"network","title":"NLTK: long vowel tokens cause CPU exhaustion in syllable tokenizer","impact":"low","summary":"NLTK's LegalitySyllableTokenizer.tokenize runs a quadratic onset reversal loop on long all-vowel tokens. A remote attacker who supplies such a token can exhaust CPU and deny service to syllabification code.","audience":"developers","category":"package","nicknames":[],"who_cares":["python","nltk"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"denial of service through CPU exhaustion on the tokenizing process","analyst_note":"Product ranges were not supplied in the input; confirm the fixed version at the vendor advisory (github.com) before relying on 3.10.4.\n","how_to_check":"- Check the installed NLTK version with `pip show nltk`\n- Look for calls to `LegalitySyllableTokenizer` in your code that take untrusted input","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["trusted-input-only","tokenizer-unused"],"who_is_affected":"Applications that pass untrusted text into NLTK's LegalitySyllableTokenizer are exposed to CPU exhaustion from crafted long tokens. Batch jobs run on trusted corpora and code that never calls this tokenizer can skip it.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000741,"input_tokens":4644,"output_tokens":553,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-126301':13A,16A '-2026':12A,15A '3.10.4':56C '3.6':54C 'algorithm':59C 'all-vowel':31B,74C 'allow':65C 'attack':37B,67C,78C 'caus':5A,90C 'code':51B 'complex':60C 'compon':105C 'contain':57C 'cpu':6A,45B,70C 'cve':11A,14A 'deni':47B,101C 'exhaust':7A,44B,69C 'legalitysyllabletokenizer.tokenize':22B,63C 'long':2A,30B,73C,86C 'loop':28B,95C 'nltk':1A,17B,20B,52C 'onset':26B,93C 'packag':18B 'perform':97C 'python':19B 'quadrat':25B,98C 'remot':36B,66C 'revers':27B,94C 'run':23B,87C 'servic':48B,102C 'submit':80C 'suppli':39B,72C 'syllabif':50B,104C 'syllabl':9A 'token':4A,10A,34B,42B,77C,82C 'unguard':92C 'vowel':3A,33B,76C,89C 'vulner':61C 'work':99C","nicknames":[],"mitigations":[],"who_affected":"Applications that pass untrusted text into NLTK's LegalitySyllableTokenizer are exposed to CPU exhaustion from crafted long tokens. Batch jobs run on trusted corpora and code that never calls this tokenizer can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["medium","nltk","package","python"],"campaign_type":null,"search_a":"'-126301':13A,16A '-2026':12A,15A 'caus':5A 'cpu':6A 'cve':11A,14A 'exhaust':7A 'long':2A 'nltk':1A 'syllabl':9A 'token':4A,10A 'vowel':3A","search_b":"'all-vowel':31B 'attack':37B 'code':51B 'cpu':45B 'deni':47B 'exhaust':44B 'legalitysyllabletokenizer.tokenize':22B 'long':30B 'loop':28B 'nltk':17B,20B 'onset':26B 'packag':18B 'python':19B 'quadrat':25B 'remot':36B 'revers':27B 'run':23B 'servic':48B 'suppli':39B 'syllabif':50B 'token':34B,42B 'vowel':33B","search_c":"'3.10.4':56C '3.6':54C 'algorithm':59C 'all-vowel':74C 'allow':65C 'attack':67C,78C 'caus':90C 'complex':60C 'compon':105C 'contain':57C 'cpu':70C 'deni':101C 'exhaust':69C 'legalitysyllabletokenizer.tokenize':63C 'long':73C,86C 'loop':95C 'nltk':52C 'onset':93C 'perform':97C 'quadrat':98C 'remot':66C 'revers':94C 'run':87C 'servic':102C 'submit':80C 'suppli':72C 'syllabif':104C 'token':77C,82C 'unguard':92C 'vowel':76C,89C 'vulner':61C 'work':99C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-26T14:11:58+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126301","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126301","severity":null,"published_at":"2026-11-13T10:17:35+00:00","modified_at":"2026-11-13T10:17:35+00:00","first_seen_at":"2026-11-13T10:47:14+00:00","fetched_at":"2026-11-13T10:47:14+00:00","note":null}],"documents":[{"id":144931,"url":"https://github.com/nltk/nltk/security/advisories/GHSA-gpwc-27cw-rh9r","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-26T14:11:58+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":144932,"url":"https://www.vulncheck.com/advisories/nltk-from-3.6-before-3.10.4-quadratic-cpu-exhaustion-via-legalitysyllabletokenizer-tokenize","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}