CVE-2026-12876: NLTK: Uncontrolled resource consumption in RecursiveDescentParser via ambiguous or left-recursive grammars

September 2, 2026

nltk.parse.RecursiveDescentParser (and SteppingRecursiveDescentParser) enumerate parses top-down with no bound on the number of recursive steps. A small, crafted context-free grammar makes a short input consume unbounded CPU (and/or exhaust the Python recursion stack), pinning a process indefinitely — a denial of service.

References

github.com/advisories/GHSA-ff5c-cp5c-9wjf
github.com/nltk/nltk/commit/43aaca1b9024138421c97f970bf13ee19ac8129d
github.com/nltk/nltk/pull/3649
github.com/nltk/nltk/releases/tag/v3.10.3
github.com/nltk/nltk/security/advisories/GHSA-ff5c-cp5c-9wjf
nvd.nist.gov/vuln/detail/CVE-2026-12876

Code Behaviors & Features

Detect and mitigate CVE-2026-12876 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →