NLTK · GHSA-qvhx-rvgc-jhwf · Package
NO FIX YET · SEE WHAT TO DO
NLTK before 3.10.4 has a quadratic-time flaw in the CoNLL SRL corpus reader, which runs when a corpus file is parsed. A crafted corpus with many predicates and span columns makes the process burn CPU for minutes, a denial of service.
first public Nov 13, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Only code that uses NLTK's ConllCorpusReader to parse CoNLL SRL corpora supplied by outside parties is exposed. Services that only process trusted local corpora or never call this reader can skip it.
Not affected if srl-reader-unused, trusted-input-only
Who cares nlp, nltk, python
pip show nltkConllCorpusReader or srl_instances calls in code that parses CoNLL SRL files from untrusted inputnltk fixed in 3.10.4This advisory has been withdrawn because it is a duplicate of GHSA-v8f3-6phw-6mh9. This link is maintained to preserve external references.
NLTK before 3.10.4 contains a quadratic-time denial of service vulnerability in ConllCorpusReader._get_srl_instances that allows remote attackers to exhaust CPU through nested span rescans. Attackers can supply a crafted CoNLL SRL corpus with many predicates and span columns, placing the head span last, to pin a core for minutes.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
GitHub Advisory Database, CC-BY 4.0. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.