3 flaws were found in the PyPI package nltk

KROMSE explanation

3 serious flaws in the PyPI package nltk (CVE-2026-126297, CVSS 8.7). The official record says: NLTK before 3.10.4 contains a quadratic-time denial of service vulnerability in ConllCorpusReader._get_srl_instances that allows remote attackers to exhaust CPU through nested span rescans.

No confirmed attacks and no public attack code yet.

Projects that use the PyPI package nltk.

  • Update nltk to 3.10.4 or later.
  • Not sure if you use it? KROMSE can check your product for free.
KROMSELive threat centreSign inAdd your repository or website to see if it impacts youAdd repo or website

Loading the story…