Description
NLTK before 3.10.4 contains an uncontrolled resource consumption vulnerability in SteppingRecursiveDescentParser.parse() that lacks any max_time deadline or step limit. Attackers influencing the grammar can supply an ambiguous self-embedding grammar and short token input to force unbounded top-down search, pinning CPU cores and exhausting worker pools.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| nltk | nltk | < 3.10.4 | 3.10.4 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | nltk | < 3.10.4 | 3.10.4 | GHSA-8fx7-8jr8-84rv |
References
- GitHub Security Advisory (GHSA-8fx7-8jr8-84rv) vendor-advisory
- VulnCheck Advisory: NLTK before 3.10.4 Denial of Service via SteppingRecursiveDescentParser.parse() third-party-advisory