CVE-2026-66393: NLTK before 3.9.4 Denial of Service via JSONTaggedDecoder
NLTK versions before 3.9.4 contain an unbounded recursion vulnerability in JSONTaggedDecoder.decodeobj() that allows attackers to cause denial of service by supplying deeply nested JSON structures. Attackers can craft JSON payloads exceeding the recursion limit to trigger an unhandled RecursionError that crashes the Python process.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
NLTKto a version that resolves this vulnerability.Fixed in 3.9.4 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch Denial of Service via JSONTaggedDecoder
Event History
Frequently Asked Questions
Who is exposed to this denial-of-service issue?
Applications using an NLTK version before 3.9.4 are exposed if they pass attacker-controlled JSON data to JSONTaggedDecoder.decode_obj(). The vulnerable condition is triggered by deeply nested JSON structures.
What does an attacker need to exploit the issue?
An attacker needs only to supply a sufficiently deeply nested JSON payload to the affected decoder. No privileges or user interaction are required according to the supplied severity vector.
What is the impact when exploitation succeeds?
The nested payload can exceed Python's recursion limit and cause an unhandled RecursionError. This crashes the Python process, resulting in denial of service.
How can I determine whether my application is affected?
Check whether it uses NLTK before version 3.9.4 and whether untrusted JSON can reach JSONTaggedDecoder.decode_obj(). If both conditions apply, the application is affected.