CVE-2026-81724

Analyzed Analyzed - Analysis Complete

Uncontrolled Recursion in NLTK FeatStructReader

Publication date: 2026-08-27

Last updated on: 2026-08-31

Assigner: VulnCheck

Description

NLTK before 3.10.3 contains an uncontrolled recursion vulnerability in nltk.featstruct.FeatStructReader that allows unauthenticated attackers to cause a denial of service by supplying deeply nested feature-structure input. Attackers can craft trivial payloads with nested brackets that exceed Python's recursion limit and raise an unhandled RecursionError, crashing applications that parse user-supplied feature structures or feature grammars.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-27

Last Modified

2026-08-31

Generated

2026-09-17

AI Q&A

2026-08-27

EPSS Evaluated

2026-09-15

NVD

CVE-2026-81724

EUVD

EUVD-2026-67074

Affected Vendors & Products

Vendor	Product	Version / Range
nltk	nltk	to 3.10.3 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-674	The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.

Attack-Flow Graph

Executive Summary

This vulnerability is an uncontrolled recursion flaw in NLTK's nltk.featstruct.FeatStructReader component. It allows attackers to cause a denial of service by submitting deeply nested feature-structure input that exceeds Python's recursion limit. This triggers an unhandled RecursionError, crashing applications parsing user-supplied feature structures or feature grammars.

Detection Guidance

To detect this vulnerability, monitor for crashes in applications using NLTK's FeatStructReader when processing feature structures. Check logs for RecursionError exceptions or HTTP 500 errors in web applications. Test by sending deeply nested bracket payloads to NLTK parsers and observe if crashes occur.

Impact Analysis

This vulnerability can crash applications that parse user-supplied feature structures or feature grammars. In web frameworks, it may cause a single request to fail with an HTTP 500 error without affecting other requests. In single-threaded or unprotected contexts, it can terminate the entire process, leading to persistent outages if unsupervised.

Compliance Impact

This vulnerability primarily causes Denial of Service (DoS) by crashing applications parsing user-supplied input. While not directly violating GDPR or HIPAA, it could lead to service disruptions affecting data availability, which may violate availability requirements under GDPR Article 32 and HIPAA Security Rule (45 CFR § 164.308(a)(7)). Organizations must ensure robust input validation to maintain compliance.

Mitigation Strategies

Upgrade NLTK to version 3.10.3 or later. If upgrading is not possible, implement input validation to reject deeply nested feature structures. Add a depth counter in FeatStructReader to enforce a maximum nesting limit and raise a ValueError instead of allowing RecursionError.

Hi! I’m here to help you understand CVE-2026-81724. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70