nltk: NLTK: Denial of Service via Uncontrolled Recursion (CVE-2026-81724)

Overview

A flaw was found in NLTK. This uncontrolled recursion vulnerability in nltk.featstruct.FeatStructReader allows unauthenticated attackers to cause a denial of service. Attackers can achieve this by supplying deeply nested feature-structure input, which can lead to applications crashing when parsing user-supplied feature structures or feature grammars.

Vendor advisories

• Red Hat VEX · Important · affected: Exploit Intelligence, Lightspeed Core, OpenShift Lightspeed, Red Hat Ansible Automation Platform 2, Red Hat OpenShift AI (RHOAI) · no fix planned: Exploit Intelligence, Red Hat Ansible Automation Platform 2, Lightspeed Core, OpenShift Lightspeed, … · updated 2026-09-15 · vex

nltk: NLTK: Denial of Service via Uncontrolled Recursion — rated Important by Red Hat. Released 2026-08-27, updated 2026-09-15.

Affected:

• Exploit Intelligence
• Lightspeed Core
• OpenShift Lightspeed
• Red Hat Ansible Automation Platform 2
• Red Hat OpenShift AI (RHOAI)

No fix planned:

• Exploit Intelligence
• Red Hat Ansible Automation Platform 2
• Lightspeed Core
• OpenShift Lightspeed
• Red Hat OpenShift AI (RHOAI)

Not affected:

• OpenShift Lightspeed

Remediation

Will not fix

Workarounds / mitigations:

• Applications that process untrusted feature-structure input using NLTK should implement robust input validation and sanitization to prevent deeply nested structures from being processed by nltk.featstruct.FeatStructReader. If input cannot be validated, avoid processing untrusted feature-structure input with affected versions of NLTK.

Package advisory (CVE-2026-81724)

Affected packages:

• nltk <= 3.10.2

Patched in:

• nltk 3.10.3

Source: https://github.com/advisories/GHSA-cw6x-m8jw-qmrh