CVE-2026-126299

A wide lexical entry could tie up an NLTK parsing worker

NLTK project · Natural Language Toolkit CCG lexicon parser

First documented disclosure · Review checkpoint

Summary

The combinatory categorial grammar parser repeatedly sliced input while reading wide categories. One input could consume excessive CPU and block other lexicon processing.

Severity and exploitation evidence

High · 8.7/10 · CVSS 4.0. Severity source.

Exploitation not established: The reviewed advisory does not report malicious exploitation.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

The combinatory categorial grammar parser repeatedly sliced input while reading wide categories.

Conditions required

An application parsed attacker-influenced CCG lexicon text.

Potential impact

One input could consume excessive CPU and block other lexicon processing.

Affected versions and configurations

Through 3.10.3.

Fix and mitigation status

3.10.4.

Practical next steps

Upgrade NLTK to 3.10.4 or later. Set limits on lexicon size and parsing time.

Operating lesson

Bound lexical structure complexity before admitting a grammar to a shared parser.

Evidence and limits

The CVE record was published on 2026-11-13.

Sources