NLTK: Quadratic-time CPU denial of service in CCG lexicon parser (fromstring) on wide bracket bodies and operator chains

🗓️ 14 Nov 2026 00:08:50Reported by GitHub Advisory DatabaseType

Unauthenticated DoS in NLTK CCG lexicon parser via quadratic-time CPU consumption.

Reporter	Title	Published	Views	Family All 10
Circl	CVE-2026-126299	13 Nov 202611:24	–	circl
CVE	CVE-2026-126299	13 Nov 202609:36	–	cve
Cvelist	CVE-2026-126299 NLTK before 3.10.4 Quadratic-Time Denial of Service via CCG Lexicon fromstring	13 Nov 202609:36	–	cvelist
EUVD	EUVD-2026-125222	14 Nov 202600:08	–	euvd
Github Security Blog	Duplicate Advisory: Quadratic-time CPU denial of service in NLTK CCG lexicon parser (fromstring) on wide bracket bodies and operator chains	13 Nov 202612:31	–	github
NVD	CVE-2026-126299	13 Nov 202610:17	–	nvd
osv_ghsa	GHSA-89P3-FCCH-88PH NLTK: Quadratic-time CPU denial of service in CCG lexicon parser (fromstring) on wide bracket bodies and operator chains	14 Nov 202600:08	–	osv_ghsa
Positive Technologies	PT-2026-146630	13 Nov 202600:00	–	ptsecurity
Positive Technologies	PT-2026-147337	14 Nov 202600:00	–	ptsecurity
Rapid7 Vulnerability Database (full)	CVE-2026-126299: nltk: NLTK before 3.10.4 contains a denial of service vulnerability in the CCG lexicon parser fromstring that allows remote…	13 Nov 202600:00	–	rapid7

Vulners

Node

nltk nltkRange≤3.10.3pip

Source	Link
github	www.github.com/nltk/nltk/security/advisories/GHSA-89p3-fcch-88ph
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-126299
github	www.github.com/nltk/nltk/pull/3944
github	www.github.com/nltk/nltk/commit/0bb5b947bd235b950cf2f90e893a498e16da0fe3
github	www.github.com/nltk/nltk/commit/cf12a5e6a
github	www.github.com/nltk/nltk/releases/tag/v3.10.4
vulncheck	www.vulncheck.com/advisories/nltk-before-3.10.4-quadratic-time-denial-of-service-via-ccg-lexicon-fromstring
github	www.github.com/advisories/GHSA-89p3-fcch-88ph

14 Nov 2026 00:08Current

6.3Medium risk

Vulners AI Score6.3

CVSS 3.17.5

CVSS 48.7

EPSS0.00576