EXECUTIVE SUMMARY:
Multiple vulnerabilities affect nltk and include denial-of-service conditions caused by uncontrolled recursion, unbounded parsing, and quadratic CPU consumption, along with a filesystem containment flaw in the downloader that can overwrite files outside the intended installation directory through pre-existing hardlinks. The vulnerabilities primarily affect applications processing attacker-controlled grammars, feature structures, XML corpus files, or text, while the downloader issue can impact integrity and availability when an attacker can influence a shared download directory. The XMLCorpusView issue also notes that a published release patch was not available at the time of its detailed assessment.[/subscribe_to_unlock_form]
EXECUTIVE SUMMARY:
Multiple vulnerabilities affect nltk and include denial-of-service conditions caused by uncontrolled recursion, unbounded parsing, and quadratic CPU consumption, along with a filesystem containment flaw in the downloader that can overwrite files outside the intended installation directory through pre-existing hardlinks. The vulnerabilities primarily affect applications processing attacker-controlled grammars, feature structures, XML corpus files, or text, while the downloader issue can impact integrity and availability when an attacker can influence a shared download directory. The XMLCorpusView issue also notes that a published release patch was not available at the time of its detailed assessment.[emaillocker id="1283"]
CVE-2026-81724 (CVSS 6.9 — Medium): A vulnerability in nltk FeatStructReader allows denial of service via uncontrolled recursion because deeply nested feature-structure input can exceed Python's recursion limit and trigger an unhandled RecursionError.
CVE-2026-12876 (CVSS 6.9 — Medium): A vulnerability in nltk's RecursiveDescentParser allows denial of service via unbounded CPU consumption and recursion when processing crafted ambiguous or left-recursive grammars.
CVE-2026-81723 (CVSS 6.3— Medium): A vulnerability in nltk's XMLCorpusView allows denial of service via quadratic CPU consumption because malformed XML input causes the parser to repeatedly rescan an increasingly large buffer, resulting in excessive CPU usage and potential application unavailability.
CVE-2026-81727 (CVSS 6.9 — Medium): A vulnerability in nltk's ZIP downloader allows filesystem containment bypass because pre-existing hardlinks inside the installation directory can redirect extracted files and overwrite files outside the intended directory.
CVE-2026-81722 (CVSS 6.9 — Medium): A vulnerability in NLTK's PorterStemmer.stem() allows denial of service via quadratic CPU consumption when processing tokens containing long runs of the letter y, potentially causing excessive CPU usage and impacting application availability.
RECOMMENDATIONS:
REFERENCES:
The following reports contain further technical details:
https://github.com/advisories/GHSA-cw6x-m8jw-qmrh
https://github.com/advisories/GHSA-ff5c-cp5c-9wjf
https://github.com/advisories/GHSA-vp2x-qp44-57v7
https://github.com/advisories/GHSA-f794-5jv7-7672
https://github.com/advisories/GHSA-ww6m-cw3f-q94g