NLTK · CVE-2026-126303 · Package
NO FIX YET · SEE WHAT TO DO
NLTK's SteppingRecursiveDescentParser.parse() has no deadline or step limit, so it can run without bound on certain inputs. An attacker who can influence the grammar and token input can pin CPU cores and exhaust worker pools, causing denial of service.
first public Oct 26, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Applications that use NLTK's SteppingRecursiveDescentParser and let outside users or data supply the grammar or token input are exposed. Code that only parses grammars the team writes itself, or that never uses this parser, can skip it.
Not affected if no-untrusted-grammars, parser-not-used
Who cares nltk, python
pip show nltk and compare it against the fixed release.SteppingRecursiveDescentParser or parse() on grammars that come from users or other untrusted input.3.10.4 or later, per the advisory description (before 3.10.4 is affected).NLTK before 3.10.4 contains an uncontrolled resource consumption vulnerability in SteppingRecursiveDescentParser.parse() that lacks any max_time deadline or step limit. Attackers influencing the grammar can supply an ambiguous self-embedding grammar and short token input to force unbounded top-down search, pinning CPU cores and exhausting worker pools.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.