CVE-2026-126301: NLTK from 3.6 before 3.10.4 Quadratic CPU Exhaustion via LegalitySyllableTokenizer.tokenize
NLTK from 3.6 before 3.10.4 contains an algorithmic complexity vulnerability in LegalitySyllableTokenizer.tokenize that allows remote attackers to exhaust CPU by supplying long all-vowel tokens. Attackers can submit a token such as a long run of vowels, causing the unguarded onset reversal loop to perform quadratic work and deny service to syllabification components.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using NLTK versions from 3.6 up to, but not including, 3.10.4 are affected when they use LegalitySyllableTokenizer.tokenize on attacker-controlled input. The impacted functionality is syllabification components that process submitted tokens.
What does an attacker need to exploit it?
An attacker can exploit the issue remotely without privileges or user interaction by supplying a long token consisting entirely of vowels. This input causes the tokenizer's unguarded onset-reversal loop to perform quadratic CPU work.
What is the impact of successful exploitation?
Successful exploitation can exhaust CPU resources and deny service to affected syllabification components. The provided severity vector indicates availability impact only, with no stated confidentiality or integrity impact.
What should be done if an immediate upgrade is not possible?
The provided information identifies long all-vowel tokens as the triggering input. Restricting or rejecting excessively long tokens before they reach LegalitySyllableTokenizer.tokenize can reduce exposure until an upgrade is possible.