THREATOPS

THREAT OPS › Threat News › [GHSA] GHSA-ff5c-cp5c-9wjf (medium) — NLTK: Uncontrolled resource consumption in RecursiveDescentParser via ambiguous or left-recursive grammars

[GHSA] GHSA-ff5c-cp5c-9wjf (medium) — NLTK: Uncontrolled resource consumption in RecursiveDescentParser via ambiguous or left-recursive grammars

medgithub_advisoriesPublished 2026-09-02

GHSA-ff5c-cp5c-9wjf Severity: medium CVE: CVE-2026-12876

NLTK: Uncontrolled resource consumption in RecursiveDescentParser via ambiguous or left-recursive grammars

`nltk.parse.RecursiveDescentParser` (and `SteppingRecursiveDescentParser`) enumerate parses top-down with no bound on the number of recursive steps. A small, crafted context-free grammar makes a short input consume unbounded CPU (and/

Indicators of compromise

CVE-2026-12876cve
CVE-2026-12875cve

Original source: https://github.com/advisories/GHSA-ff5c-cp5c-9wjf