CVE-2026-126299

Name of the Vulnerable Software and Affected Versions NLTK versions prior to 3.10.4

Description A denial of service issue exists in the CCG lexicon parser. Remote attackers can cause CPU exhaustion by providing wide inputs, such as lexicon text with long flat bracket bodies or operator chains. This triggers quadratic string re-slicing within the matchBrackets() and augParseCategory() functions, which blocks worker threads and leads to availability loss. The issue is accessible via the nltk.ccg.lexicon.fromstring endpoint (also re-exported as nltk.ccg.chart.fromstring). The existing recursion-depth guard does not prevent this because the malicious inputs are flat, meaning their nesting depth remains at zero.

Recommendations Update to version 3.10.4 or later. As a temporary mitigation, restrict the size of accepted lexicon input and parse it under a CPU or time budget in an isolated worker.