Description
NLTK before 3.10.4 contains a denial of service vulnerability in Tree.chomsky_normal_form that allows remote attackers to exhaust CPU through quadratic-time right-factor binarization using list.pop(0). Attackers can supply a wide flat treebank tree parsed by Tree.fromstring to force tens of seconds of single-threaded CPU consumption, blocking the processing thread.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| nltk | nltk | < 3.10.4 | 3.10.4 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | nltk | < 3.10.4 | 3.10.4 | GHSA-r53h-rw34-8h97 |
References
- GitHub Security Advisory (GHSA-r53h-rw34-8h97) vendor-advisory
- VulnCheck Advisory: NLTK before 3.10.4 Quadratic CPU Denial of Service via Tree.chomsky_normal_form third-party-advisory