NLTK 3.10.3 and earlier vulnerable to CPU DoS: upgrade to 3.10.4

GitHub Advisories reports a vulnerability in the right-factor step of NLTK’s syntax-tree conversion. See the GHSA-r53h-rw34-8h97 advisory for the source information.

Overview and technical details

NLTK is a Python natural language processing library; Tree.chomsky_normal_form() converts a parse tree to Chomsky normal form. CVE-2026-126298 can cause processing wide tree inputs to consume CPU.

Affected systems

Mechanism and impact

The default right-factor branch repeatedly calls list.pop(0) while binarizing a tree node. Shifting elements makes the operation O(N²); an attacker can provide a wide tree through Tree.fromstring to an application that calls Tree.chomsky_normal_form(), consuming CPU on a single thread and reducing availability. No authentication or user interaction is required. About 1.5 MB of tree data can consume approximately 14 seconds on one core. The left-factor branch uses pop() and has linear complexity; regular-expression timeouts do not cover this Python loop.

System checks

1. Check the NLTK version installed in the application’s Python environment:

   Copy commands

   python -m pip show nltk
   python -c "import nltk; print(nltk.__version__)"

   Version 3.10.4 includes the fix; version 3.10.3 and earlier are affected.

Remediation and mitigation

1. Prioritize upgrading NLTK to version 3.10.4.

2. If you cannot upgrade yet, limit the number of children in untrusted input trees and run the transformation in an isolated worker with a CPU or time budget.

References

• GitHub Advisories: GHSA-r53h-rw34-8h97