CVE-2026-126299 json
NLTK before 3.10.4 Quadratic-Time Denial of Service via CCG Lexicon fromstring
published 19d ago modified yesterday also EUVD-2026-125222 , GHSA-89p3-fcch-88ph
- cvss
- 7.5
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.6%
- EPSS 0.6% chance of exploitation in 30 days, percentile 48%
- public exploits
- 0
- none known
Summary
NLTK before 3.10.4 contains a denial of service vulnerability in the CCG lexicon parser fromstring that allows remote attackers to exhaust CPU by supplying wide inputs. Attackers can submit lexicon text with long flat bracket bodies or operator chains, triggering quadratic string re-slicing in matchBrackets and augParseCategory that blocks worker threads.
Patch / fix
- pypi nltk 3.10.4
- nltk nltk 3.10.4
- github.com/nltk/nltk@0bb5b94 commit
- github.com/nltk/nltk@cf12a5e commit
- github.com/nltk/nltk#3944 pull request
- github.com/nltk/nltk/releases/tag/v3.10.4 release
Is CVE-2026-126299 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- yes
- Technical impact
- partial
- Assessed
- yesterday
Exploit prediction
0.58% chance of exploitation in the next 30 days, higher than 48% of all scored CVEs (FIRST EPSS, 2026-11-14).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 8.7 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N |
| CNA | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| GitHub | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| CNA | 4.0 | 8.7 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | nltk | <3.10.4 |
3.10.4 |
Affected products
- nltk nltk
Classification
References
-
github.com
/nltk/nltk/pull/3944
web
-
github.com
/nltk/nltk/commit/0bb5b947bd235b950cf2f90e893a498e16da0fe3
web
-
github.com
/nltk/nltk/commit/cf12a5e6a
web
-
github.com
/nltk/nltk/security/advisories/GHSA-89p3-fcch-88ph
vendor-advisory, web, advisory
-
vulncheck.com
/advisories/nltk-before-3.10.4-quadratic-time-denial-of-service-via-ccg-lexicon-fromstring
third-party-advisory, web
-
nvd.nist.gov
/vuln/detail/CVE-2026-126299
advisory
-
github.com
/nltk/nltk
package
-
github.com
/nltk/nltk/releases/tag/v3.10.4
web
Sources
- CVE List CVE-2026-126299
- GitHub Advisory GHSA-89p3-fcch-88ph
- NVD CVE-2026-126299
- Maintainer advisory GHSA-89p3-fcch-88ph
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
The maintainers of nltk/nltk published their own advisory on GitHub. Reviewed sources take precedence over it.