CVE-2026-126301

A long token could exhaust CPU during NLTK syllabification

NLTK project · Natural Language Toolkit legality syllable tokenizer

First documented disclosure · Review checkpoint

Summary

The legality-based syllable tokenizer repeatedly rebuilt a growing sequence while processing a word. One token could consume disproportionate CPU and delay other work.

Severity and exploitation evidence

Medium · 6.9/10 · CVSS 4.0. Severity source.

Exploitation not established: The reviewed advisory does not report malicious exploitation.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

The legality-based syllable tokenizer repeatedly rebuilt a growing sequence while processing a word.

Conditions required

A caller could supply untrusted tokens to a service using this syllabifier.

Potential impact

One token could consume disproportionate CPU and delay other work.

Affected versions and configurations

3.6 through 3.10.3.

Fix and mitigation status

3.10.4.

Practical next steps

Upgrade NLTK to 3.10.4 or later. Cap token length in applications accepting untrusted text.

Operating lesson

Apply per-token limits as well as total request-size limits.

Evidence and limits

The CVE record was published on 2026-11-13.

Sources