CVE-2026-126300

Text could drive excessive CPU use in NLTK’s Treebank span tokenizer

NLTK project · Natural Language Toolkit Treebank word span tokenizer

First documented disclosure · Review checkpoint

Summary

Span tokenization repeatedly shifted elements when aligning quote tokens with source text. A single request could consume a CPU core and delay tokenization for other users.

Severity and exploitation evidence

Medium · 6.9/10 · CVSS 4.0. Severity source.

Exploitation not established: The reviewed advisory does not report malicious exploitation.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

Span tokenization repeatedly shifted elements when aligning quote tokens with source text.

Conditions required

A service used the Treebank span tokenizer on untrusted input.

Potential impact

A single request could consume a CPU core and delay tokenization for other users.

Affected versions and configurations

3.2.5 through 3.10.3.

Fix and mitigation status

3.10.4.

Practical next steps

Upgrade NLTK to 3.10.4 or later. Limit the amount of text processed in a single tokenization request.

Operating lesson

Check worst-case cost in token-to-source alignment.

Evidence and limits

The CVE record was published on 2026-11-13.

Sources