Uncontrolled Recursion in Natural Language Toolkit - #VU142774
Published: August 15, 2026
Vulnerability identifier: #VU142774
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-674
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to uncontrolled recursion in nltk.featstruct.FeatStructReader when parsing deeply nested feature-structure or feature-grammar input. A remote attacker can send a specially crafted nested input to cause a denial of service.
The issue is reachable through both FeatStruct(str) and FeatureGrammar.fromstring() when applications parse externally supplied text.
Affected software
Natural Language Toolkit
Remediation
Install security update from vendor's website.
Natural Language Toolkit - update to 3.10.3