Denial of Service Vulnerability in NLTK Before 3.10.3

CVE-2026-81724

What is CVE-2026-81724?

The NLTK library, prior to version 3.10.3, is susceptible to an uncontrolled recursion vulnerability within its FeatStructReader component. This flaw allows unauthenticated attackers to exploit the system by providing deeply nested feature-structure input that exceeds the recursion limit of Python. Such crafted inputs can trigger an unhandled RecursionError, leading to system crashes for applications that parse user-provided feature structures or grammars. This can severely affect application stability and availability, posing significant risks for developers utilizing NLTK.

References