NLTK patches a DoS flaw in ConllCorpusReader: upgrade to version 3.10.4

GitHub Advisories reported CVE-2026-126297 in the NLTK Python library, which can make an application unavailable when processing certain CoNLL data. The advisory recommends upgrading to NLTK 3.10.4; see GitHub Advisory GHSA-v8f3-6phw-6mh9.

Overview and technical details

NLTK is a Python library for natural language processing. The vulnerability is in ConllCorpusReader.srl_instances(), which creates semantic role labeling instances from CoNLL corpora. When triggered, the flaw causes prolonged CPU consumption and affects availability.

Affected systems

The vulnerability applies when an application processes untrusted CoNLL data through the SRL API with the words, pos, tree, and srl columns, and calls srl_instances(). Deployments that do not call this function are not affected.

Mechanism and impact

The _get_srl_instances function scans span columns in nested loops to find the head of each predicate, with complexity O(P^2 * R). Placing the only head span in the final column forces the function to scan all preceding columns for each predicate, resulting in prolonged single-threaded CPU consumption and potential service unavailability.

Authentication or user interaction is not required for the affected condition. The confirmed impact is DoS; the advisory states that confidentiality and integrity are not affected.

System checks

1. Check the NLTK version installed in the application's Python environment:

   Copy commands

   python -m pip show nltk

   Version 3.10.4 contains the fix; versions 3.10.3 and earlier are affected.

Remediation and mitigation

1. Upgrade the pip:nltk package to version 3.10.4, particularly if the application processes untrusted CoNLL corpora and calls srl_instances().

References

• GitHub Advisories: GHSA-v8f3-6phw-6mh9