CVE-2026-126301

Name of the Vulnerable Software and Affected Versions NLTK versions 3.6 through 3.10.3

Description An algorithmic complexity issue exists in the LegalitySyllableTokenizer.tokenize function. When this function processes a single token consisting of a long sequence of vowels, it triggers an unguarded processing loop that performs quadratic work. This occurs because the function walks the token in reverse and repeatedly builds and hashes a growing string, leading to CPU consumption that increases proportionally to the square of the token length. A remote attacker can exploit this by supplying a long all-vowel token to the public tokenizer API, which can saturate a CPU core and cause a denial of service or significant latency degradation for any service that syllabifies untrusted text.

Recommendations Update NLTK to version 3.10.4 or later. As a temporary workaround, restrict the maximum length of tokens passed to the LegalitySyllableTokenizer.tokenize function at the application boundary to prevent the processing of excessively long inputs.