Denial of Service in NLTK Affecting Python Applications by NLTK

CVE-2026-66393

What is CVE-2026-66393?

NLTK versions prior to 3.9.4 are susceptible to a denial of service vulnerability originating from the JSONTaggedDecoder.decode_obj() function. An attacker can exploit this flaw by sending JSON payloads with deeply nested structures, which surpass the allowed recursion limit. This leads to an unhandled RecursionError, resulting in a crash of the affected Python process. It is essential for users to update to the latest version to mitigate this risk and ensure application stability.

References