CVE-2026-126301

The NLTK library, versions 3.6 through 3.10.3 , is vulnerable to a quadratic CPU exhaustion issue within the LegalitySyllableTokenizer.tokenize method. This algorithmic complexity vulnerability (CWE-407) is triggered when the software processes long, all-vowel tokens. Specifically, an unguarded o...