EUVD-2026-125220

NLTK from 3.6 before 3.10.4 contains an algorithmic complexity vulnerability in LegalitySyllableTokenizer.tokenize that allows remote attackers to exhaust CPU by supplying long all-vowel tokens. Attackers can submit a token such as a long run of vowels, causing the unguarded onset reversal loop t...

CVE-2026-126301

The NLTK library, versions 3.6 through 3.10.3 , is vulnerable to a quadratic CPU exhaustion issue within the LegalitySyllableTokenizer.tokenize method. This algorithmic complexity vulnerability (CWE-407) is triggered when the software processes long, all-vowel tokens. Specifically, an unguarded o...

CVE-2026-126301 NLTK from 3.6 before 3.10.4 Quadratic CPU Exhaustion via LegalitySyllableTokenizer.tokenize

NLTK from 3.6 before 3.10.4 contains an algorithmic complexity vulnerability in LegalitySyllableTokenizer.tokenize that allows remote attackers to exhaust CPU by supplying long all-vowel tokens. Attackers can submit a token such as a long run of vowels, causing the unguarded onset reversal loop t...