NLTK · GHSA-6665-2vj3-h76r · Package
NO FIX YET · SEE WHAT TO DO
NLTK before 3.10.4 has a quadratic-time loop in Tree.chomsky_normal_form that uses list.pop(0) during right-factor binarization. An remote attacker who supplies a wide, flat treebank tree to Tree.fromstring can tie up a thread for tens of seconds.
first public Nov 13, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Applications that parse untrusted treebank input with NLTK's Tree.fromstring and then call chomsky_normal_form are exposed. Projects that only parse their own trusted trees or do not use this method can skip it.
Not affected if method-not-used, trusted-input-only
Who cares nlp, nltk, python
pip show nltkTree.fromstring on untrusted input followed by chomsky_normal_formnltk 3.10.4 or later, per the affected range in the advisory dataThis advisory has been withdrawn because it is a duplicate of GHSA-r53h-rw34-8h97. This link is maintained to preserve external references.
NLTK before 3.10.4 contains a denial of service vulnerability in Tree.chomsky_normal_form that allows remote attackers to exhaust CPU through quadratic-time right-factor binarization using list.pop(0). Attackers can supply a wide flat treebank tree parsed by Tree.fromstring to force tens of seconds of single-threaded CPU consumption, blocking the processing thread.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
GitHub Advisory Database, CC-BY 4.0. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.