---
id: CVE-2026-66393
title: >-
  NLTK versions before 3.9.4 contain an unbounded recursion vulnerability in
  JSONTaggedDecoder.decode_obj() that allows attackers to cause denial of
  service by supplying deeply nested JSON structures
summary: >-
  NLTK versions before 3.9.4 contain an unbounded recursion vulnerability in
  JSONTaggedDecoder.decode_obj() that allows attackers to cause denial of
  service by supplying deeply nested JSON structures. Attackers can craft JSON
  payloads exce…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
cwe:
  - CWE-674
published: '2026-08-22'
updated: '2026-08-22'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-66393'
references:
  - url: 'https://github.com/nltk/nltk/security/advisories/GHSA-rf74-v2fm-23pw'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/nltk-before-denial-of-service-via-jsontaggeddecoder
    label: disclosure@vulncheck.com
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-66393'
  - url: >-
      https://github.com/nltk/nltk/commit/00cdcd392142e6c745e7120c8d50a24127df5fad
  - url: 'https://github.com/nltk/nltk'
  - url: >-
      https://github.com/pypa/advisory-database/tree/main/vulns/nltk/PYSEC-2026-3724.yaml
tags:
  - nvd
  - osv
  - pip
ingestedAt: '2026-08-23T04:42:15.429Z'
epss: 0.00521
epssPercentile: 0.41721
aliases:
  - GHSA-rf74-v2fm-23pw
  - PYSEC-2026-3724
ecosystem: pip
vendor: nltk
product: nltk
affected:
  - nltk < 3.9.4
patched:
  - nltk 3.9.4
---

## Overview

NLTK versions before 3.9.4 contain an unbounded recursion vulnerability in JSONTaggedDecoder.decode_obj() that allows attackers to cause denial of service by supplying deeply nested JSON structures. Attackers can craft JSON payloads exceeding the recursion limit to trigger an unhandled RecursionError that crashes the Python process.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-66393)

Affected packages:

- `nltk < 3.9.4`

Patched in:

- `nltk 3.9.4`

Source: https://osv.dev/vulnerability/GHSA-rf74-v2fm-23pw