CVE-2026-126303

An ambiguous grammar could occupy an NLTK parser indefinitely

NLTK project · Natural Language Toolkit stepping recursive-descent parser

First documented disclosure · Review checkpoint

Summary

The parser explored competing interpretations without a time deadline or step budget. Unbounded parsing could occupy cores and exhaust the service’s worker pool.

Severity and exploitation evidence

High · 8.7/10 · CVSS 4.0. Severity source.

Exploitation not established: The reviewed advisory does not report malicious exploitation.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

The parser explored competing interpretations without a time deadline or step budget.

Conditions required

An attacker could influence the supplied grammar and input.

Potential impact

Unbounded parsing could occupy cores and exhaust the service’s worker pool.

Affected versions and configurations

Through 3.10.3.

Fix and mitigation status

3.10.4.

Practical next steps

Upgrade NLTK to 3.10.4 or later. Enforce parsing budgets when accepting externally supplied grammars.

Operating lesson

Set a budget for grammar search even when the token sequence is short.

Evidence and limits

The CVE record was published on 2026-11-13.

Sources