Staging Environment: Content and features may be unstable or change without notice.
Advisory details: gitlab / pypi/nltk/CVE-2026-81724
Advisory ID gitlab/pypi/nltk/CVE-2026-81724
Aliases CVE-2026-81724
GHSA-cw6x-m8jw-qmrh
Summary NLTK: Uncontrolled recursion in nltk.featstruct.FeatStructReader causes unhandled RecursionError (DoS) via deeply nested feature-structure input `nltk.featstruct.FeatStructReader` (used by `FeatStruct(str)` and by `FeatureGrammar.fromstring()`) parses feature-structure strings such as `[a=1]` with a recursive-descent parser that has no nesting-depth limit. A small, trivially-crafted input (~700 bytes) with deeply nested brackets drives the parser past Python's recursion limit and raises an **unhandled `RecursionError`** instead of the library's normal, catchable `ValueError`/`LogicalExpressionException`. Any application that parses user-supplied feature-structure or feature-grammar text (e.g. NLP teaching tools, grammar "playgrounds", unification-grammar-based NLU pipelines) can be crashed by an unauthenticated input with no special privileges. This is a Denial of Service issue (CWE-674, Uncontrolled Recursion), not a memory-safety or code-execution issue. This appears to be the same bug class as two issues already fixed elsewhere in the codebase — `nltk/jsontags.py` (`JSONTaggedDecoder.decode_obj`, guarded by `MAX_DECODE_DEPTH = 200`) and `nltk/sem/logic.py` (`LogicParser`, guarded by `MAX_PARSE_DEPTH = 200`) — but `nltk/featstruct.py` does not have an equivalent guard.
Status Published
Exploitability 0.5
Weighted Severity 0.0
Risk
Affected and Fixed Packages Package Details
Introduced and Fixed Package Commit Patches Package Commit Patches Details
Weaknesses (3)
CWE-674 Uncontrolled Recursion
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
cvssv3.1 https://gitlab.com/gitlab-org/advisories-community/-/blob/main/pypi/nltk/CVE-2026-81724.yml
Reference id Reference type URL
https://github.com/nltk/nltk/commit/43c7b78cc8ea37e5cd3a129e27e32c415ea21cf1
https://github.com/nltk/nltk/releases/tag/v3.10.3
https://github.com/nltk/nltk/security/advisories/GHSA-cw6x-m8jw-qmrh
https://github.com/pypa/advisory-database/tree/main/vulns/nltk/PYSEC-2026-3739.yaml
https://www.vulncheck.com/advisories/nltk-before-3.10.3-denial-of-service-via-uncontrolled-recursion
CVE-2026-81724 https://nvd.nist.gov/vuln/detail/CVE-2026-81724
GHSA-cw6x-m8jw-qmrh https://github.com/advisories/GHSA-cw6x-m8jw-qmrh
No exploits are available.

No EPSS data available for this advisory.

Patch URL
There are no known patches.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L Found at https://gitlab.com/gitlab-org/advisories-community/-/blob/main/pypi/nltk/CVE-2026-81724.yml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none

There are no SSVC decisions available.