mediumCVSS 5.3Vulnerability

GHSA-pf76-q698-37v8

## Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-cw6x-m8jw-qmrh. This link is maintained to preserve external references. ## Original Description NLTK before 3.10.3 contains an uncontrolled recursion vulnerability in nltk.featstruct.FeatStructReader that allows unauthenticated attackers to cause a denial of service by supplying deeply nested feature-structure input. Attackers can craft trivial payloads with nested brackets that exceed Python's recursion limit and raise an unhandled RecursionError, crashing applications that parse user-supplied feature structures or feature grammars.

Properties

ghsa_id
GHSA-pf76-q698-37v8
severity
medium
summary
Duplicate Advisory: Uncontrolled recursion in nltk.featstruct.FeatStructReader causes unhandled RecursionError (DoS) via deeply nested feature-structure input
cvss_score
5.3
cve_id
GHSA-pf76-q698-37v8
cvss_vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
is_ghsa_only
true
ghsa_published
2026-08-27T18:32:30Z
source_url
https://github.com/advisories/GHSA-pf76-q698-37v8
ghsa_updated
2026-09-02T14:33:13Z

Related Entities (4)

VULNERABLE_TO (1)

[Software]pip/nltk

AFFECTS (1)

[Software]pip/nltk

HAS_WEAKNESS (1)

[Weakness]Uncontrolled Recursion

REPORTED_BY (1)

[Source]GitHub Advisory Database

Explore deeper with Ninja Signal's threat intelligence graph

GHSA-pf76-q698-37v8 (CVSS 5.3) — Ninja Signal Threat Intelligence | Ninja Signal