Description
NLTK from 3.2.5 before 3.10.4 contains an algorithmic complexity vulnerability in TreebankWordTokenizer.span_tokenize that allows remote attackers to cause quadratic CPU consumption through repeated list.pop(0) calls. Attackers can submit long runs of double-quote characters to services span-tokenizing untrusted text, exhausting a CPU core and degrading availability.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| nltk | nltk | 3.2.5 <3.10.4 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | nltk | >= 3.2.5, < 3.10.4 | 3.10.4 | GHSA-ffr9-mgrr-wcvr |