CVE-2026-81724High· 7.5▾ TwilightA flaw was found in NLTK. This uncontrolled recursion vulnerability in `nltk.featstruct.FeatStructReader` allows unauthenticated attackers to cause a denial of service. Attackers can achieve this by supplying deeply nested feature-structur…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Sep 2.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CSAF
0.3%
7.5 → 5.3
high → medium
5.3 → 7.5
medium → high
7.5 → 5.3
high → medium
5.3 → 7.5
medium → high
7.5 → 5.3
high → medium
5.3 → 7.5
medium → high
0.3% → 0.5%
Last analysed / modified upstream
A flaw was found in NLTK. This uncontrolled recursion vulnerability in nltk.featstruct.FeatStructReader allows unauthenticated attackers to cause a denial of service. Attackers can achieve this by supplying deeply nested feature-structure input, which can lead to applications crashing when parsing user-supplied feature structures or feature grammars.
nltk: NLTK: Denial of Service via Uncontrolled Recursion — rated Important by Red Hat. Released 2026-08-27, updated 2026-10-19.
Affected:
Fixed:
No fix planned:
Not affected:
For Red Hat OpenShift AI 3.3.7 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update:
https://docs.redhat.com/en/documentation/red_hat_openshift_ai/ https://access.redhat.com/errata/RHSA-2026:73987 For Red Hat OpenShift AI 3.4.5 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update:
https://docs.redhat.com/en/documentation/red_hat_openshift_ai/ https://access.redhat.com/errata/RHSA-2026:84734 For Red Hat OpenShift AI 3.5.1 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update:
https://docs.redhat.com/en/documentation/red_hat_openshift_ai/ https://access.redhat.com/errata/RHSA-2026:69539
Workarounds / mitigations:
nltk.featstruct.FeatStructReader. If input cannot be validated, avoid processing untrusted feature-structure input with affected versions of NLTK.Affected packages:
nltk <= 3.10.2Patched in:
nltk 3.10.3Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-81722High· 7.5nltk: nltk PorterStemmer: Denial of Service due to inefficient token processing (CVE-2026-81722)
CVE-2026-80205High· 7.5nltk: NLTK: Denial of Service via unvalidated regular expressions (CVE-2026-80205)
CVE-2026-79674High· 7.5nltk: NLTK: Information disclosure via path traversal in corpus-reader constructors (CVE-2026-79674)
CVE-2026-81727High· 7.1nltk: NLTK: Filesystem containment bypass allows local file overwrite (CVE-2026-81727)
CVE-2026-79675High· 8.1nltk: NLTK before 3.10.3 JVM Argument Injection via Per-Call Options (CVE-2026-79675)
CVE-2026-48712High· 7.5protobufjs: protobufjs: Denial of Service via uncontrolled recursion with crafted protobuf payload (CVE-2026-48712)