CVE-2026-66393High· 7.5▾ TwilightNLTK versions before 3.9.4 contain an unbounded recursion vulnerability in JSONTaggedDecoder.decode_obj() that allows attackers to cause denial of service by supplying deeply nested JSON structures. Attackers can craft JSON payloads exce…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Aug 23.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.5%
NLTK versions before 3.9.4 contain an unbounded recursion vulnerability in JSONTaggedDecoder.decode_obj() that allows attackers to cause denial of service by supplying deeply nested JSON structures. Attackers can craft JSON payloads exceeding the recursion limit to trigger an unhandled RecursionError that crashes the Python process.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
nltk < 3.9.4Patched in:
nltk 3.9.4Connected by shared product, vendor, weakness, or advisory.
CVE-2026-12876MediumNLTK: Uncontrolled resource consumption in RecursiveDescentParser via ambiguous or left-recursive grammars
CVE-2024-39705High· 7.5ntlk unsafe deserialization vulnerability
CVE-2026-12259Medium· 5.3NLTK: Missing Post-Download Integrity Verification Allows Malicious Package Injection
CVE-2026-80206HighNLTK: ReDoS in nltk.tgrep via unvalidated user-supplied regular expressions
CVE-2026-78681HighNLTK: Entity-expansion DoS (billion laughs) via remaining raw ElementTree parses
CVE-2026-79676HighNLTK: Corpus readers follow symlinks outside trusted roots despite pathsec enforcement