EUVD-2026-125221

NLTK from 3.2.5 before 3.10.4 contains an algorithmic complexity vulnerability in TreebankWordTokenizer.spantokenize that allows remote attackers to cause quadratic CPU consumption through repeated list.pop0 calls. Attackers can submit long runs of double-quote characters to services...

CVE-2026-126300

The NLTK library, versions 3.2.5 to before 3.10.4 , is vulnerable to an algorithmic complexity vulnerability in the TreebankWordTokenizer.span_tokenize function. The root cause is repeated list.pop(0) calls, which allow a remote attacker to trigger quadratic CPU consumption . By submitting long s...