CVE-2026-126299
HIGH
NVD
CVSS Score
7.5
Severity
HIGH
Published
Nov 13, 2026
Vendor
unknown
Description
NLTK before 3.10.4 contains a denial of service vulnerability in the CCG lexicon parser fromstring that allows remote attackers to exhaust CPU by supplying wide inputs. Attackers can submit lexicon text with long flat bracket bodies or operator chains, triggering quadratic string re-slicing in matchBrackets and augParseCategory that blocks worker threads.