CVE-2026-126297: NLTK before 3.10.4 CPU Denial of Service via ConllCorpusReader srl_instances
NLTK before 3.10.4 contains a quadratic-time denial of service vulnerability in ConllCorpusReader.getsrlinstances that allows remote attackers to exhaust CPU through nested span rescans. Attackers can supply a crafted CoNLL SRL corpus with many predicates and span columns, placing the head span last, to pin a core for minutes.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Applications using NLTK versions before 3.10.4 that process attacker-controlled CoNLL semantic role labeling (SRL) corpora are exposed. The issue can be triggered remotely when an attacker can cause the application to parse a crafted corpus.
What does an attacker need to exploit it?
No authentication or user interaction is required. The attacker needs to supply a CoNLL SRL corpus containing many predicates and span columns, with the head span placed last.
What is the impact of successful exploitation?
The crafted input causes nested span rescans with quadratic-time behavior, allowing an attacker to exhaust CPU resources. A single processing task can pin a CPU core for minutes, resulting in denial of service.
How can this be remediated?
Upgrade NLTK to version 3.10.4 or later. If upgrading cannot happen immediately, do not process untrusted CoNLL SRL corpora and apply resource limits to parsing workloads.