CVE-2026-81724

NLTK <3.10.3 RecursionError DoS via deep nested feature-structure input.

• CVSS 6.9
• 674
• Resource Management
• Remote

NLTK before 3.10.3 contains an uncontrolled recursion vulnerability in nltk.featstruct.FeatStructReader that allows unauthenticated attackers to cause a denial of service by supplying deeply nested feature-structure input. Attackers can craft trivial payloads with nested brackets that exceed Python's recursion limit and raise an unhandled RecursionError, crashing applications that parse user-supplied feature structures or feature grammars.

CVE

CVE-2026-81724

CWE

674

CVSS base score

6.9

Published

2026-08-27

OWASP

A06 Vulnerable and Outdated Components

Orthogonal defect classification

Checking

Code defect classification

Missing Check

Category

Resource Management

Subcategory

Resource Exhaustion

Accessibility scope

Remote

Impact

Denial of Service (DoS)

Affected component

NLTK

Fixed by upgrading

Yes

Solution

Upgrade NLTK to version 3.10.3 or newer.

import nltk
from nltk.featstruct import FeatStructReader

def parse_featstruct(s: str):
    # VULNERABLE: unlimited recursion on nested feature structures
    reader = FeatStructReader()
    return reader.parse(s)

import nltk
from nltk.featstruct import FeatStructReader

def parse_featstruct(s: str):
    # FIX: limit recursion depth to prevent denial of service
    reader = FeatStructReader()
    # monkey‑patch the internal recursion guard
    original_parse = reader.parse

    def safe_parse(txt):
        import sys
        max_depth = 100  # safe recursion limit
        orig_limit = sys.getrecursionlimit()
        sys.setrecursionlimit(min(orig_limit, max_depth))
        try:
            return original_parse(txt)
        finally:
            sys.setrecursionlimit(orig_limit)

    reader.parse = safe_parse
    return reader.parse(s)

__VAITP_MODEL_REFUSED__

@misc{vaitp:cve202681724,
  title        = {{NLTK <3.10.3 RecursionError DoS via deep nested feature-structure input.}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2026},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2026-81724},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2026-81724/}}
}