NLTK · GHSA-4hvg-fv5c-9936 · Package
NO FIX YET · SEE WHAT TO DO
This advisory is withdrawn as a duplicate of GHSA-8fx7-8jr8-84rv, which covers the same NLTK parser flaw. The original text says an attacker who controls the grammar can supply an ambiguous self-embedding grammar and short input to make SteppingRecursiveDescentParser.parse() run without limit, pinning CPU cores.
first public Nov 13, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Applications that build NLTK grammars from untrusted input and parse them with SteppingRecursiveDescentParser. Projects that only parse fixed, trusted grammars are not exposed. Use GHSA-8fx7-8jr8-84rv as the live record.
Not affected if no-stepping-parser, trusted-grammars-only
Who cares nltk, python
pip show nltk.SteppingRecursiveDescentParser and check whether grammars come from untrusted input.nltk before 3.10.4 per the original description; the fixed version in the product data is not stated.This advisory has been withdrawn because it is a duplicate of GHSA-8fx7-8jr8-84rv. This link is maintained to preserve external references.
NLTK before 3.10.4 contains an uncontrolled resource consumption vulnerability in SteppingRecursiveDescentParser.parse() that lacks any max_time deadline or step limit. Attackers influencing the grammar can supply an ambiguous self-embedding grammar and short token input to force unbounded top-down search, pinning CPU cores and exhausting worker pools.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
GitHub Advisory Database, CC-BY 4.0. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.