NLTK versions through 3.10.3 vulnerable to CPU exhaustion; upgrade to 3.10.4

GitHub Advisories published CVE-2026-126303 in NLTK, a Python package for natural language processing. The flaw affects a step-based grammar parsing method and is fixed in version 3.10.4.

Overview and technical details

SteppingRecursiveDescentParser parses context-free grammars by stepping through them. The vulnerability is identified as CVE-2026-126303 and GHSA-8fx7-8jr8-84rv.

Affected systems

Practical risk depends on whether a system uses SteppingRecursiveDescentParser. The stepping parser is primarily intended for debugging or interactive use, so exposure is narrower than simply having NLTK installed.

Mechanism and impact

SteppingRecursiveDescentParser.parse() runs a step loop without setting or checking a time limit. With a short input and an ambiguous or self-embedding grammar controlled by an actor, top-down search may traverse a derivation space that grows according to the Catalan numbers, pin one CPU core, and fail to return.

If a service uses this parser to analyze untrusted input, repeated requests may exhaust the worker pool and cause denial of service. The described impact is resource consumption and denial of service.

System checks

1. Check the installed NLTK version in the Python environment:

   Copy commands

   python -m pip show nltk

   Version 3.10.4 is fixed; versions 3.10.3 and earlier need to be upgraded.

Remediation and mitigation

1. Upgrade the pip:nltk package to version 3.10.4. Prioritize systems that use SteppingRecursiveDescentParser to process grammars or input controlled by external actors.

References

• GitHub Advisories: GHSA-8fx7-8jr8-84rv