{"id":"GHSA-jh6r-h4rx-2j3w","kind":"vulnerability","aliases":["GHSA-jh6r-h4rx-2j3w"],"related":[],"title":"Duplicate Advisory: Quadratic-time CPU denial of service in NLTK CCG lexicon parser (fromstring) on wide bracket bodies and operator chains","description":"## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of GHSA-89p3-fcch-88ph. This link is maintained to preserve external references.\n\n## Original Description\nNLTK before 3.10.4 contains a denial of service vulnerability in the CCG lexicon parser fromstring that allows remote attackers to exhaust CPU by supplying wide inputs. Attackers can submit lexicon text with long flat bracket bodies or operator chains, triggering quadratic string re-slicing in matchBrackets and augParseCategory that blocks worker threads.","summary":"NLTK before 3.10.4 has a CCG lexicon parser (fromstring) whose string handling runs in quadratic time on wide bracket bodies or operator chains. A remote attacker who supplies such lexicon text can exhaust CPU and block worker threads.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"nltk","fixed":[],"affected":"< 3.10.4","ecosystem":"pypi"}],"ecosystems":["pypi"],"tags":["cwe-400","nltk","package","python"],"not_affected_if":["no-ccg-parser-use","trusted-input-only"],"how_to_check":"- Check the installed NLTK version with `pip show nltk`\n- Look for code that calls the CCG lexicon parser `fromstring` on input that comes from outside the application","fix":"- Upgrade `nltk` to `3.10.4` or later","status":"withdrawn","published_at":"2026-11-13T12:31:16+00:00","first_seen_at":"2026-11-13T23:07:33+00:00","triaged_at":"2026-11-13T23:07:38+00:00","updated_at":"2026-11-13T23:07:38+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-13T23:07:38Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade `nltk` to `3.10.4` or later","reach":"internet","title":"NLTK: CCG lexicon parser lets crafted input exhaust CPU","impact":"low","summary":"NLTK before 3.10.4 has a CCG lexicon parser (fromstring) whose string handling runs in quadratic time on wide bracket bodies or operator chains. A remote attacker who supplies such lexicon text can exhaust CPU and block worker threads.","audience":"developers","category":"package","nicknames":[],"who_cares":["python","nltk"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"Remote input exhausts CPU and blocks worker threads","analyst_note":"","how_to_check":"- Check the installed NLTK version with `pip show nltk`\n- Look for code that calls the CCG lexicon parser `fromstring` on input that comes from outside the application","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["trusted-input-only","no-ccg-parser-use"],"who_is_affected":"Applications that parse CCG lexicon text with NLTK's fromstring, especially where the lexicon comes from users or untrusted sources. This advisory is withdrawn as a duplicate of GHSA-89p3-fcch-88ph, so check that advisory for the authoritative details. Teams that only use NLTK on trusted, local data can skip it.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000738,"input_tokens":4721,"output_tokens":531,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-400':35B '2j3w':27A,32A '3.10.4':41B,107C '88ph':94C '89p3':92C 'advisori':2A,78C,80C 'allow':121C 'attack':64B,123C,131C 'augparsecategori':153C 'block':74B,155C 'bodi':19A,58B,140C 'bracket':18A,57B,139C 'ccg':12A,44B,116C 'chain':22A,61B,143C 'contain':108C 'cpu':6A,72B,126C 'cwe':34B 'denial':7A,110C 'descript':104C 'duplic':1A,77C,88C 'exhaust':71B,125C 'extern':101C 'fcch':93C 'flat':138C 'fromstr':15A,47B,119C 'ghsa':24A,29A,91C 'ghsa-89p3-fcch-88ph':90C 'ghsa-jh6r-h4rx-2j3w':23A,28A 'h4rx':26A,31A 'handl':50B 'input':130C 'jh6r':25A,30A 'lexicon':13A,45B,68B,117C,134C 'link':96C 'long':137C 'maintain':98C 'matchbracket':151C 'nltk':11A,33A,36B,39B,105C 'oper':21A,60B,142C 'origin':103C 'packag':37B 'parser':14A,46B,118C 'preserv':100C 'python':38B 'quadrat':4A,53B,145C 'quadratic-tim':3A 're':148C 're-slic':147C 'refer':102C 'remot':63B,122C 'run':51B 'servic':9A,112C 'slice':149C 'string':49B,146C 'submit':133C 'suppli':66B,128C 'text':69B,135C 'thread':76B,157C 'time':5A,54B 'trigger':144C 'vulner':113C 'whose':48B 'wide':17A,56B,129C 'withdrawn':83C 'worker':75B,156C","nicknames":[],"mitigations":[],"who_affected":"Applications that parse CCG lexicon text with NLTK's fromstring, especially where the lexicon comes from users or untrusted sources. This advisory is withdrawn as a duplicate of GHSA-89p3-fcch-88ph, so check that advisory for the authoritative details. Teams that only use NLTK on trusted, local data can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":["nltk"],"ptokens":["nltk"],"labels":["cwe400","high","nltk","package","pypi","python"],"campaign_type":null,"search_a":"'2j3w':27A,32A 'advisori':2A 'bodi':19A 'bracket':18A 'ccg':12A 'chain':22A 'cpu':6A 'denial':7A 'duplic':1A 'fromstr':15A 'ghsa':24A,29A 'ghsa-jh6r-h4rx-2j3w':23A,28A 'h4rx':26A,31A 'jh6r':25A,30A 'lexicon':13A 'nltk':11A,33A 'oper':21A 'parser':14A 'quadrat':4A 'quadratic-tim':3A 'servic':9A 'time':5A 'wide':17A","search_b":"'-400':35B '3.10.4':41B 'attack':64B 'block':74B 'bodi':58B 'bracket':57B 'ccg':44B 'chain':61B 'cpu':72B 'cwe':34B 'exhaust':71B 'fromstr':47B 'handl':50B 'lexicon':45B,68B 'nltk':36B,39B 'oper':60B 'packag':37B 'parser':46B 'python':38B 'quadrat':53B 'remot':63B 'run':51B 'string':49B 'suppli':66B 'text':69B 'thread':76B 'time':54B 'whose':48B 'wide':56B 'worker':75B","search_c":"'3.10.4':107C '88ph':94C '89p3':92C 'advisori':78C,80C 'allow':121C 'attack':123C,131C 'augparsecategori':153C 'block':155C 'bodi':140C 'bracket':139C 'ccg':116C 'chain':143C 'contain':108C 'cpu':126C 'denial':110C 'descript':104C 'duplic':77C,88C 'exhaust':125C 'extern':101C 'fcch':93C 'flat':138C 'fromstr':119C 'ghsa':91C 'ghsa-89p3-fcch-88ph':90C 'input':130C 'lexicon':117C,134C 'link':96C 'long':137C 'maintain':98C 'matchbracket':151C 'nltk':105C 'oper':142C 'origin':103C 'parser':118C 'preserv':100C 'quadrat':145C 're':148C 're-slic':147C 'refer':102C 'remot':122C 'servic':112C 'slice':149C 'string':146C 'submit':133C 'suppli':128C 'text':135C 'thread':157C 'trigger':144C 'vulner':113C 'wide':129C 'withdrawn':83C 'worker':156C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T12:31:16+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-jh6r-h4rx-2j3w","url":"https://github.com/advisories/GHSA-jh6r-h4rx-2j3w","severity":"high","published_at":"2026-11-13T12:31:16+00:00","modified_at":"2026-11-13T23:04:16+00:00","first_seen_at":"2026-11-13T23:07:33+00:00","fetched_at":"2026-11-13T23:12:39+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}