CVE-2026-126297
A semantic role corpus could monopolize an NLTK processing worker
NLTK project · Natural Language Toolkit CoNLL semantic role corpus reader
First documented disclosure · Review checkpoint
Summary
The corpus reader repeatedly scanned spans while extracting semantic roles. Processing one corpus could consume sustained CPU and delay other work.
Severity and exploitation evidence
High · 8.7/10 · CVSS 4.0. Severity source.
Exploitation not established: The reviewed advisory does not report malicious exploitation.
Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.
How the weakness works
The corpus reader repeatedly scanned spans while extracting semantic roles.
Conditions required
The application accepted untrusted CoNLL semantic role data.
Potential impact
Processing one corpus could consume sustained CPU and delay other work.
Affected versions and configurations
Through 3.10.3.
Fix and mitigation status
3.10.4.
Practical next steps
Upgrade NLTK to 3.10.4 or later. Limit corpus size and processing time for external submissions.
Operating lesson
Budget work performed per annotation, including repeated span scans.
Evidence and limits
The CVE record was published on 2026-11-13.
Sources
- Maintainer security advisory
Primary source ·
- VulnCheck CVE record
Primary source ·