CVE-2026-66393
Received Received - Intake

NLTK Unbounded Recursion in JSONTaggedDecoder.decode_obj()

Publication date: 2026-08-22

Last updated on: 2026-08-22

Assigner: VulnCheck

Description
NLTK versions before 3.9.4 contain an unbounded recursion vulnerability in JSONTaggedDecoder.decode_obj() that allows attackers to cause denial of service by supplying deeply nested JSON structures. Attackers can craft JSON payloads exceeding the recursion limit to trigger an unhandled RecursionError that crashes the Python process.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-22
Last Modified
2026-08-22
Generated
2026-08-22
AI Q&A
2026-08-22
EPSS Evaluated
N/A
NVD
CVE-2026-66393
EUVD
EUVD-2026-64310

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
nltk nltk to 3.9.4 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-674 The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-66393 is an unbounded recursion vulnerability in NLTK versions before 3.9.4. It exists in the JSONTaggedDecoder.decode_obj() function, which processes nested JSON structures without a depth limit. Attackers can exploit this by sending deeply nested JSON payloads that exceed Python's recursion limit, causing an unhandled RecursionError and crashing the Python process.

Detection Guidance

To detect this vulnerability, check the installed NLTK version using 'pip show nltk' or 'python -c "import nltk; print(nltk.__version__)"'. If the version is below 3.9.4, the system is vulnerable. Monitor for crashes when processing JSON with deeply nested structures.

Impact Analysis

This vulnerability allows attackers to cause denial-of-service (DoS) by crashing the Python process. If your application uses NLTK versions before 3.9.4 and processes untrusted JSON input, it could be vulnerable to crashes, leading to service disruption or downtime.

Mitigation Strategies

Upgrade NLTK to version 3.9.4 or later immediately using 'pip install --upgrade nltk'. Avoid processing untrusted JSON inputs with JSONTaggedDecoder until patched. Implement input validation to limit JSON nesting depth.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-66393. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart