NLTK Tree.chomsky_normal_form DoS via list.pop(0)

Executive Summary

This is a denial-of-service vulnerability in NLTK versions before 3.10.4. It occurs in the Tree.chomsky_normal_form method when processing wide flat treebank trees. The issue stems from using list.pop(0) which has quadratic time complexity O(N^2), causing excessive CPU consumption and blocking processing for tens of seconds on a single core.

Useful 0 Not Useful 0

Detection Guidance

Check NLTK version with pip show nltk. If version is below 3.10.4, the system is vulnerable. Monitor CPU usage spikes during NLTK tree processing tasks. Look for processes calling Tree.chomsky_normal_form with large inputs.

Useful 0 Not Useful 0

Impact Analysis

An attacker can remotely exploit this by supplying a specially crafted tree structure. This would consume excessive CPU resources, potentially blocking the processing thread and making the application unresponsive for extended periods. No authentication or user interaction is required.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade NLTK to version 3.10.4 or later immediately. If upgrading is not possible, restrict input size for Tree.chomsky_normal_form calls or implement custom binarization logic using collections.deque to avoid list.pop(0).

Useful 0 Not Useful 0