CVE-2026-126298

A wide syntax tree could stall NLTK tree normalization

NLTK project · Natural Language Toolkit tree normalization

First documented disclosure · Review checkpoint

Summary

Converting wide trees to Chomsky normal form repeatedly shifted remaining elements. CPU use could grow quadratically and block the processing thread.

Severity and exploitation evidence

High · 8.7/10 · CVSS 4.0. Severity source.

Exploitation not established: The reviewed advisory does not report malicious exploitation.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

Converting wide trees to Chomsky normal form repeatedly shifted remaining elements.

Conditions required

An application normalized a syntax tree supplied by an untrusted party.

Potential impact

CPU use could grow quadratically and block the processing thread.

Affected versions and configurations

Through 3.10.3.

Fix and mitigation status

3.10.4.

Practical next steps

Upgrade NLTK to 3.10.4 or later. Limit tree width and processing time for untrusted treebanks.

Operating lesson

Account for tree width when setting parser limits.

Evidence and limits

The CVE record was published on 2026-11-13.

Sources