CVE-2026-81724: NLTK before 3.10.3 Denial of Service via Uncontrolled Recursion
NLTK before 3.10.3 contains an uncontrolled recursion vulnerability in nltk.featstruct.FeatStructReader that allows unauthenticated attackers to cause a denial of service by supplying deeply nested feature-structure input. Attackers can craft trivial payloads with nested brackets that exceed Python's recursion limit and raise an unhandled RecursionError, crashing applications that parse user-supplied feature structures or feature grammars.
Affected Software
Event History
Frequently Asked Questions
Which applications are exposed to this denial-of-service condition?
Applications using NLTK versions before 3.10.3 are exposed if they parse user-supplied feature structures or feature grammars through nltk.featstruct.FeatStructReader.
What does an attacker need to exploit this issue?
An attacker needs only network-accessible input that reaches the affected feature-structure parser. No authentication, user interaction, or special privileges are required.
How can exploitation affect an application?
A deeply nested bracket payload can exceed Python's recursion limit, trigger an unhandled RecursionError, and crash the application or affected parsing operation.
What version resolves the issue?
Upgrade NLTK to version 3.10.3 or later. Versions before 3.10.3 are affected.