MEDIUM GitHub
CVE-2026-12876
NLTK: Uncontrolled resource consumption in RecursiveDescentParser via ambiguous or left-recursive grammars
`nltk.parse.RecursiveDescentParser` (and `SteppingRecursiveDescentParser`) enumerate parses top-down with no bound on the number of recursive steps. A small, crafted context-free grammar makes a short input consume unbounded CPU (and/or exhaust the Python recursion stack), pinning a process indefinitely — a denial of service.
## Proof of concept
Both of the following hang on a 24-token input (killed after 8s; growth is super-linear in input length), on NLTK develop:
```python
from nltk import
Affected Products
- pip/nltk <= 3.10.2
References
- https://github.com/advisories/GHSA-ff5c-cp5c-9wjf
- https://github.com/nltk/nltk/security/advisories/GHSA-ff5c-cp5c-9wjf
- https://github.com/nltk/nltk/pull/3649
- https://github.com/nltk/nltk/commit/43aaca1b9024138421c97f970bf13ee19ac8129d
This medium severity vulnerability was published on 2026-09-02 via GitHub. Affected: pip/nltk <= 3.10.2.
vulnfeed aggregates 11639 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.