GitHub Advisory Database warns about a flaw in nltk
KROMSE explanation
nltk has a serious security flaw (CVE-2026-126298, CVSS 8.7). The official record says: NLTK before 3.10.4 contains a denial of service vulnerability in Tree.chomsky_normal_form that allows remote attackers to exhaust CPU through quadratic-time right-factor binarization using list.pop(0).
No confirmed attacks and no public attack code yet.
Anyone running nltk older than 3.10.4.
- Update nltk to 3.10.4 or later.
- Not sure if you use it? KROMSE can check your product for free.
