CVE-2026-126297

Name of the Vulnerable Software and Affected Versions NLTK versions prior to 3.10.4

Description A denial of service issue exists where remote attackers can exhaust CPU resources by providing a specially crafted CoNLL SRL corpus. The problem occurs when the srl instances() public entry point calls the get srl instances() function, which performs a nested rescan of span columns for each predicate. By placing the head span in the last column, an attacker can force a quadratic-time operation O(P^2 * R), where P is the number of predicates and R is the number of spans. This can pin a CPU core for several minutes with only a few megabytes of data. No authentication or user interaction is required for this to occur.

Recommendations Update to version 3.10.4 or later. As a temporary workaround, restrict the use of the srl instances() function when processing untrusted CoNLL data. As a temporary workaround, cap the maximum accepted size of corpus files to minimize the impact of CPU exhaustion.