GitHub Advisory Database warns about a flaw in nltk

2026-11-14

KROMSE explanation

nltk has a serious security flaw (CVE-2026-126299, CVSS 8.7). The official record says: NLTK before 3.10.4 contains a denial of service vulnerability in the CCG lexicon parser fromstring that allows remote attackers to exhaust CPU by supplying wide inputs.

Not confirmed yet, but attack code is public, so attacks often follow within days.

Anyone running nltk older than 3.10.4.

Update nltk to 3.10.4 or later.
Not sure if you use it? KROMSE can check your product for free.

KROMSELive threat centreSign inAdd your repository or website to see if it impacts youAdd repo or website

GitHub Advisory Database warns about a flaw in nltk

KROMSE explanation

Loading the story…