CVE-2026-81723: NLTK before 3.10.3 Quadratic CPU Exhaustion via XMLCorpusView
NLTK versions before 3.10.3 contain a quadratic CPU exhaustion vulnerability in XMLCorpusView.readxmlfragment() that rescans accumulated XML fragments on every 1 KiB block read. Attackers can provide malformed XML corpus files to cause severe CPU consumption and denial of service through affected readers like BNCCorpusReader.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
nltkto a version that resolves this vulnerability.Fixed in 3.10.3
Event History
Frequently Asked Questions
What must an attacker be able to do to trigger the denial of service?
An attacker must be able to provide a malformed XML corpus file that is processed by an affected NLTK XML reader, such as BNCCorpusReader. No authentication or user interaction is required according to the supplied vector.
Which deployments are realistically exposed?
Deployments are exposed when they use NLTK before 3.10.3 and process XML corpus files from untrusted or attacker-influenced sources through XMLCorpusView-based readers. The impact is CPU exhaustion and resulting denial of service; confidentiality and integrity are not affected.
What is the available remediation?
Upgrade NLTK to version 3.10.3 or later. The affected range is NLTK versions before 3.10.3.