NLTK 3.10.3 and earlier affected by CPU DoS; upgrade to 3.10.4

GitHub Advisories reports CVE-2026-126299 in the Python NLTK library. The flaw is in CCG lexicon parsing and is fixed in version 3.10.4. View advisory GHSA-89p3-fcch-88ph.

Overview and technical details

NLTK is a Python natural language processing library; its CCG lexicon parser converts lexical text into structures used for language processing. The uncontrolled resource consumption and inefficient algorithmic complexity allow lexicon input to increase CPU processing time.

Affected systems

Mechanism and impact

The public functions nltk.ccg.lexicon.fromstring and its re-exported name nltk.ccg.chart.fromstring process lexicon strings supplied by the caller. In matchBrackets, the tail is repeatedly sliced for each character in a wide bracket body; in augParseCategory, the tail is copied for each operator in a long string. These operations have O(n²) complexity.

An attacker can supply input through an application that calls these functions, causing prolonged single-threaded CPU consumption, exhausting workers, and making the service unavailable. No authentication or user interaction is required. MAX_PARSE_DEPTH = 500 limits nesting depth only and does not block flat, wide input; regex timeouts also do not cover these Python loops.

System checks

1. Check the NLTK version managed by pip:

   Copy commands

   pip show nltk

   Version 3.10.3 and earlier are affected; 3.10.4 is fixed.

Remediation and mitigation

1. Upgrade the package with pip to nltk 3.10.4, prioritizing applications that parse CCG lexicons controlled by users or untrusted sources.

2. After upgrading, run pip show nltk and confirm the installed version is 3.10.4.

The described fix uses index pointers on the original string or collections.deque to avoid repeatedly slicing or copying the tail.