CVE-2026-126297 — NLTK
HIGHCVE-2026-126297 is a high-severity (CVSS 7.5) Uncontrolled Resource Consumption vulnerability in nltk nltk. A fix is available — see the affected versions and patch details below.
NLTK before 3.10.4 contains a quadratic-time denial of service vulnerability in ConllCorpusReader._get_srl_instances that allows remote attackers to exhaust CPU through nested span…
Description
NLTK before 3.10.4 contains a quadratic-time denial of service vulnerability in ConllCorpusReader._get_srl_instances that allows remote attackers to exhaust CPU through nested span rescans. Attackers can supply a crafted CoNLL SRL corpus with many predicates and span columns, placing the head span last, to pin a core for minutes.
Affected Products
nltknltkDetection & mitigation playbook
Vendor / applianceDetect
Inventory every nltk nltk deployment and check each version against the affected-products list above.
Fix
Apply the nltk nltk security patch or hotfix for CVE-2026-126297 on the affected version, following the vendor advisory for your exact build.
Workarounds
Cap what an attacker can consume: apply request size, rate and timeout limits in front of the affected component, and run it with memory and CPU limits so exhaustion degrades one worker rather than the whole service. Alongside that, restrict the management interface to trusted networks and apply the vendor's recommended configuration mitigations.
Frequently Asked Questions
Is CVE-2026-126297 being exploited in your environment?
Detect and block the exploit chain at execution, on systems you cannot patch yet.