CVE-2026-81724

NLTK before 3.10.3 contains an uncontrolled recursion vulnerability in nltk.featstruct.FeatStructReader that allows unauthenticated attackers to cause a denial of service by supplying deeply nested feature-structure input. Attackers can craft trivial payloads with nested brackets that exceed Python's recursion limit and raise an unhandled RecursionError, crashing applications that parse user-supplied feature structures or feature grammars.

Database specific

{
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-674"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/81xxx/CVE-2026-81724.json"
}

References

Affected packages

Git / github.com/nltk/nltk

Affected ranges

Type

GIT

Repo

https://github.com/nltk/nltk

Events

Introduced

Fixed

303f6e2ba8e4548a5f54fd65d86bb5c9a949f1db

Database specific

Show details

{
    "cpe": "cpe:2.3:a:nltk:nltk:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "3.10.3"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "CPE_RANGE"
    ]
}

Affected versions

2.*

2.0.1rc1

2.0.1rc2

2.0.1rc3

2.0.1rc4

3.*

3.0.0b1

3.0.2

3.0.3

3.0.4

3.0.5

3.0a4

3.1

3.2

3.2.1

3.2.2

3.2.3

3.2.4

3.2.5

3.3

3.4

3.4.1

3.4.3

3.4.4

3.5

3.5b1

3.6

3.6.1

3.6.2

3.6.5

3.6.6

3.6.7

3.7

3.8

3.8.1

3.8.2

3.9

3.9.1

3.9.2

3.9.3

3.9.4

v.*

v.3.10.1

v3.*

v3.10.0

v3.10.0-rc1

v3.10.0-rc2

v3.10.1

v3.10.1-rc1

v3.10.1-rc2

v3.10.2

v3.10.2-rc1

v3.9.2

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-81724.json"