THREATOPS
THREAT OPS › Threat News › [GHSA] GHSA-vp2x-qp44-57v7 (medium) — NLTK: Quadratic CPU Exhaustion in `XMLCorpusView._read_xml_fragment()`

[GHSA] GHSA-vp2x-qp44-57v7 (medium) — NLTK: Quadratic CPU Exhaustion in `XMLCorpusView._read_xml_fragment()`

medgithub_advisoriesPublished 2026-09-02

GHSA-vp2x-qp44-57v7 Severity: medium CVE: CVE-2026-81723

NLTK: Quadratic CPU Exhaustion in `XMLCorpusView._read_xml_fragment()`

## Summary

`XMLCorpusView._read_xml_fragment()` reads a corpus file in 1 KiB blocks, appending each block to a growing `fragment` string, then calls `_VALID_XML_RE.match(fragment)` on the full accumulated buffer every iteration. Because each iteration rescans the entir

MITRE ATT&CK techniques

Indicators of compromise

Original source: https://github.com/advisories/GHSA-vp2x-qp44-57v7