{"id":"CVE-2026-126301","summary":"NLTK from 3.6 before 3.10.4 Quadratic CPU Exhaustion via LegalitySyllableTokenizer.tokenize","details":"NLTK from 3.6 before 3.10.4 contains an algorithmic complexity vulnerability in LegalitySyllableTokenizer.tokenize that allows remote attackers to exhaust CPU by supplying long all-vowel tokens. Attackers can submit a token such as a long run of vowels, causing the unguarded onset reversal loop to perform quadratic work and deny service to syllabification components.","aliases":["GHSA-gpwc-27cw-rh9r"],"modified":"2026-11-15T02:46:05.315047892Z","published":"2026-11-13T09:36:25.223Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/126xxx/CVE-2026-126301.json","cna_assigner":"VulnCheck","cwe_ids":["CWE-407"]},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/126xxx/CVE-2026-126301.json"},{"type":"ADVISORY","url":"https://github.com/nltk/nltk/security/advisories/GHSA-gpwc-27cw-rh9r"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126301"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/nltk-from-3.6-before-3.10.4-quadratic-cpu-exhaustion-via-legalitysyllabletokenizer-tokenize"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/nltk/nltk","events":[{"introduced":"24d6e0d4123a5cfea3ede7dbdfe77fe0ec54b83c"},{"fixed":"5c41fc04a45e95577a83f3914acda211a994be00"}],"database_specific":{"extracted_events":[{"source":"AFFECTED_FIELD","strategy":"StandardRange","range":[{"introduced":"3.6"},{"fixed":"3.10.4"}]},{"range":[{"introduced":"3.6"},{"fixed":"3.10.4"}],"source":"DESCRIPTION"}]}}],"versions":["v3.10.4-rc1","v3.10.3-rc1","v3.10.3","v3.10.2-rc1","v3.10.2","v3.10.1","v.3.10.1","v3.10.1-rc2","v3.10.0-rc2","v3.10.0","v3.10.1-rc1","v3.10.0-rc1","3.9.4","3.9.3","v3.9.2","3.9.2","3.9.1","3.9","3.8.2","3.8.1","3.8","3.7","3.6.7","3.6.6","3.6.5","3.6.2","3.6.1","3.6"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-126301.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"}]}