CVE-2026-126298

Name of the Vulnerable Software and Affected Versions NLTK versions prior to 3.10.4

Description An issue exists where remote attackers can cause a denial of service by exhausting CPU resources. This occurs when the application processes a wide flat treebank tree using the Tree.fromstring parser and subsequently normalizes it using the Tree.chomsky normal form() function. The default right-factor binarization process uses list.pop(0), which results in quadratic-time complexity O(N^2) because it shifts all remaining elements in the list during each iteration. An attacker can provide a specially crafted tree (approximately 1.5 MB) to force sustained single-threaded CPU consumption for tens of seconds, blocking the processing thread. This affects the nltk.tree.transforms.chomsky normal form function and the Tree.chomsky normal form and Tree.fromstring endpoints.

Recommendations Update NLTK to version 3.10.4 or later. As a temporary workaround, restrict the maximum child count of trees accepted for normalization or execute the transform within an isolated worker with a strict CPU or time budget.