2 flaws were found in the PyPI package nltk
KROMSE explanation
2 serious flaws in the PyPI package nltk (CVE-2026-126303, CVSS 8.7). The official record says: NLTK before 3.10.4 contains an uncontrolled resource consumption vulnerability in SteppingRecursiveDescentParser.parse() that lacks any max_time deadline or step limit.
Not confirmed yet, but attack code is public, so attacks often follow within days.
Projects that use the PyPI package nltk.
- Update nltk to 3.10.4 or later.
- Not sure if you use it? KROMSE can check your product for free.
