CVE-2026-126300

Name of the Vulnerable Software and Affected Versions NLTK versions 3.2.5 through 3.10.3

Description An algorithmic complexity issue exists in the TreebankWordTokenizer.span tokenize function. The function contains an unguarded processing loop during its quote-restoration step that performs a list.pop(0) operation for each quote token found in the input. Because removing the first element of a Python list is an O(n) operation, the total processing time grows quadratically relative to the input length. A remote attacker can exploit this by submitting long sequences of double-quote characters to services that perform span-tokenization on untrusted text. This can lead to single-core CPU exhaustion, resulting in a denial of service or significant latency degradation for the affected system.

Recommendations As a temporary workaround, restrict the maximum length of input text passed to the TreebankWordTokenizer.span tokenize function at the application boundary to bound the worst-case processing time. At the moment, there is no information about a newer version that contains a fix for this vulnerability.