NLTK CCG Lexicon Parser Denial of Service

Executive Summary

This is a denial of service vulnerability in NLTK versions before 3.10.4. It involves the CCG lexicon parser's fromstring function, which inefficiently processes inputs with long bracket bodies or operator chains. The issue causes quadratic string re-slicing operations in matchBrackets and augParseCategory functions, leading to excessive CPU consumption and system unresponsiveness.

Useful 0 Not Useful 0

Detection Guidance

Monitor CPU usage spikes during lexicon parsing operations. Check for processes running NLTK's fromstring function with unusually long inputs. Inspect network traffic for large payloads sent to NLTK-based services.

Useful 0 Not Useful 0

Impact Analysis

An attacker can exploit this by sending specially crafted input to consume CPU resources, causing the system to become slow or unresponsive. This can block worker threads, disrupt services, and lead to downtime. The attack requires no authentication or user interaction and can be triggered remotely.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade NLTK to version 3.10.4 or later. Implement input size limits for lexicon parsing functions. Add rate limiting to prevent large payload submissions. Monitor for CPU exhaustion patterns.

Useful 0 Not Useful 0