CVE-2026-126303

NLTK before 3.10.4 contains an uncontrolled resource consumption vulnerability in SteppingRecursiveDescentParser.parse that lacks any maxtime deadline or step limit. Attackers influencing the grammar can supply an ambiguous self-embedding grammar and short token input to force unbounded top-down...

CVE-2026-126303

The NLTK library before version 3.10.4 is vulnerable to an uncontrolled resource consumption (CWE-400) flaw in the SteppingRecursiveDescentParser.parse() function. The root cause is the lack of a max_time deadline or step limit, which allows an attacker who can influence the grammar to provide an...

CVE-2026-126303 NLTK before 3.10.4 Denial of Service via SteppingRecursiveDescentParser.parse()

NLTK before 3.10.4 contains an uncontrolled resource consumption vulnerability in SteppingRecursiveDescentParser.parse that lacks any maxtime deadline or step limit. Attackers influencing the grammar can supply an ambiguous self-embedding grammar and short token input to force unbounded top-down...

EUVD-2026-125218

NLTK before 3.10.4 contains an uncontrolled resource consumption vulnerability in SteppingRecursiveDescentParser.parse that lacks any maxtime deadline or step limit. Attackers influencing the grammar can supply an ambiguous self-embedding grammar and short token input to force unbounded top-down...

CVE-2026-126303 NLTK before 3.10.4 Denial of Service via SteppingRecursiveDescentParser.parse()

NLTK before 3.10.4 contains an uncontrolled resource consumption vulnerability in SteppingRecursiveDescentParser.parse that lacks any maxtime deadline or step limit. Attackers influencing the grammar can supply an ambiguous self-embedding grammar and short token input to force unbounded top-down...