Description
NLTK before 3.10.4 contains a quadratic-time denial of service vulnerability in ConllCorpusReader._get_srl_instances that allows remote attackers to exhaust CPU through nested span rescans. Attackers can supply a crafted CoNLL SRL corpus with many predicates and span columns, placing the head span last, to pin a core for minutes.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| nltk | nltk | 0 <3.10.4 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | nltk | < 3.10.4 | 3.10.4 | GHSA-v8f3-6phw-6mh9 |