CVE-2026-126303 json
NLTK before 3.10.4 Denial of Service via SteppingRecursiveDescentParser.parse()
published 18d ago modified 8h ago also EUVD-2026-125218 , GHSA-8fx7-8jr8-84rv
- cvss
- 7.5
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.5%
- EPSS 0.5% chance of exploitation in 30 days, percentile 42%
- public exploits
- 0
- none known
Summary
NLTK before 3.10.4 contains an uncontrolled resource consumption vulnerability in SteppingRecursiveDescentParser.parse() that lacks any max_time deadline or step limit. Attackers influencing the grammar can supply an ambiguous self-embedding grammar and short token input to force unbounded top-down search, pinning CPU cores and exhausting worker pools.
Patch / fix
- pypi nltk 3.10.4
- nltk nltk 3.10.4
- github.com/nltk/nltk@e20c40e commit
- github.com/nltk/nltk#3895 pull request
Is CVE-2026-126303 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 8h ago
Exploit prediction
0.49% chance of exploitation in the next 30 days, higher than 42% of all scored CVEs (FIRST EPSS, 2026-11-13).
Exploits and checks
- github.com https://github.com/nltk/nltk/security/advisories/GHSA-8fx7-8jr8-84rv referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 8.7 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N |
| CNA | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| GitHub | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| CNA | 4.0 | 8.7 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | nltk | <3.10.4 |
3.10.4 |
Affected products
- nltk nltk
Classification
References
-
github.com
/nltk/nltk/pull/3895
web
-
github.com
/nltk/nltk/commit/e20c40e26ec9306de885703f6e53250695f1f49b
web
-
github.com
/nltk/nltk/security/advisories/GHSA-8fx7-8jr8-84rv
vendor-advisory, exploit, web, advisory
-
vulncheck.com
/advisories/nltk-before-3.10.4-denial-of-service-via-steppingrecursivedescentparser-parse
third-party-advisory, web
-
nvd.nist.gov
/vuln/detail/CVE-2026-126303
advisory
-
github.com
/nltk/nltk
package
Sources
- CVE List CVE-2026-126303
- GitHub Advisory GHSA-8fx7-8jr8-84rv
- NVD CVE-2026-126303
- Maintainer advisory GHSA-8fx7-8jr8-84rv
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
The maintainers of nltk/nltk published their own advisory on GitHub. Reviewed sources take precedence over it.