Inefficient Algorithmic Complexity in Natural Language Toolkit - #VU142778
Published: August 15, 2026
Vulnerability identifier: #VU142778
CSH Severity: Low
CVSS v4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-407
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to inefficient algorithmic complexity in XMLCorpusView._read_xml_fragment() when processing attacker-controlled XML corpus files. A remote attacker can supply a malformed XML file to cause a denial of service.
The issue is triggered by quadratic rescanning of the accumulated fragment buffer, and no user interaction is required.
Affected software
Natural Language Toolkit
Remediation
Install security update from vendor's website.
Natural Language Toolkit - update to 3.10.2