GHSA-GPWC-27CW-RH9R: CVE-2026-126301: Quadratic CPU Exhaustion in NLTK LegalitySyllableTokenizer

A security advisory disclosed CVE-2026-126301, a quadratic CPU exhaustion vulnerability in NLTK's LegalitySyllableTokenizer.tokenize method affecting versions 3.6 through 3.10.3. Long runs of vowels trigger an unguarded string reversal and set membership loop that runs in O(n^2) time, letting remote attackers cause single-core CPU exhaustion and application-level denial of service; a public proof-of-concept exists. NLTK 3.10.4 fixes the flaw by capping tokens at MAX_TOKEN_LEN = 4096 and bounding onset growth and reversal to max_onset length, reducing complexity to O(n * max_onset).

CVE-2026-126301: Quadratic CPU Exhaustion in NLTK LegalitySyllableTokenizer Vulnerability ID: GHSA-GPWC-27CW-RH9R CVSS Score: 5.3 Published: 2026-11-13 The Natural Language Toolkit NLTK versions 3.6 through 3.10.3 contain an algorithmic complexity vulnerability in the LegalitySyllableTokenizer.tokenize method. When processing tokens composed of continuous runs of vowels, an unguarded string reversal and set membership lookup loop executes in quadratic time relative to the input token length. Remote attackers capable of submitting arbitrary text to applications utilizing this tokenizer can trigger sustained single-core CPU exhaustion and application-level denial of service. TL;DR An unguarded loop in NLTK's LegalitySyllableTokenizer.tokenize method causes quadratic O n^2 CPU exhaustion when processing long vowel sequences, allowing unauthenticated attackers to cause a denial of service. ⚠️ Exploit Status: POC Technical Details - CVE ID : CVE-2026-126301 GHSA-gpwc-27cw-rh9r - Weakness Class : CWE-407 Inefficient Algorithmic Complexity / CWE-400 - Affected Component : nltk.tokenize.legality principle.LegalitySyllableTokenizer.tokenize - CVSS v3.1 / v4.0 : 5.3 Medium v3.1 / 6.9 Medium v4.0 - EPSS Score : 0.51% 44.01st Percentile - Impact : Single-core CPU Exhaustion / Application Denial of Service - Exploit Status : Public Proof-of-Concept PoC Available - Patched Version : nltk 3.10.4 Affected Systems - Python applications and NLP pipelines utilizing nltk.tokenize.LegalitySyllableTokenizer - nltk : = 3.6, < 3.10.4 Fixed in: 3.10.4 Code Analysis Introduces MAX TOKEN LEN = 4096 to LegalitySyllableTokenizer and raises ValueError on oversized tokens. Bounds current onset growth and reversal to max onset length, reducing time complexity from O n^2 to O n max onset . Exploit Details - GitHub Security Advisory https://github.com/nltk/nltk/security/advisories/GHSA-gpwc-27cw-rh9r : Public advisory containing proof-of-concept verification script demonstrating quadratic CPU growth on all-vowel strings. Mitigation Strategies - Upgrade NLTK to version 3.10.4 or higher to incorporate algorithmic linearization and token length limits. - Enforce strict maximum token length validation at the application boundary prior to invoking NLP tokenization methods. - Implement exception handling for ValueError around tokenization calls to gracefully handle rejected oversized tokens. - Configure reverse proxies and API gateways to restrict maximum HTTP request payload sizes. Remediation Steps: 1. Update project dependency specifications e.g., requirements.txt, pyproject.toml, or Pipfile to require nltk =3.10.4. 2. Run 'pip install --upgrade "nltk =3.10.4"' across all affected virtual environments and container images. 3. Audit application code calling LegalitySyllableTokenizer.tokenize to ensure ValueError exceptions are caught and handled appropriately. 4. If immediate upgrading is blocked, implement a wrapper function that rejects or truncates tokens exceeding 1,000 characters before passing them to LegalitySyllableTokenizer. References Read the full report for GHSA-GPWC-27CW-RH9R on our website https://cvereports.com/reports/GHSA-GPWC-27CW-RH9R for more details including interactive diagrams and full exploit analysis.