Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

5 records

Release: nltk 3.10.3 Clear all filters
TI-2026-56375 CVE-2026-81727 · GHSA-f794-5jv7-7672

NLTK before 3.10.3 Hardlink File Overwrite via downloader

Priority MEDIUM 64

NLTK versions before 3.10.3 contain a filesystem containment bypass vulnerability in the Downloader.download and Downloader.incr_download methods that allows attackers to overwrite files outside the install root through…

CVSS 4.0MEDIUM 6.9 Local Low privileges No interaction EPSS 0.00187 Published 2026-08-27 Partial fix · 3.10.3 CWE-59
TI-2026-56373 CVE-2026-81725 · GHSA-8mpw-7fpc-4gqj

NLTK before 3.10.3 Regular Expression Denial of Service via Pl196xCorpusReader

Priority LOW 28

NLTK before 3.10.3 contains a regular expression denial of service vulnerability in Pl196xCorpusReader that allows attackers to cause quadratic CPU consumption by supplying malformed TEI blocks with many unmatched openin…

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00369 Published 2026-08-27 Partial fix · 3.10.3 CWE-400
TI-2026-56372 CVE-2026-81724 · GHSA-cw6x-m8jw-qmrh

NLTK before 3.10.3 Denial of Service via Uncontrolled Recursion

Priority HIGH 70

NLTK before 3.10.3 contains an uncontrolled recursion vulnerability in nltk.featstruct.FeatStructReader that allows unauthenticated attackers to cause a denial of service by supplying deeply nested feature-structure inpu…

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00456 Published 2026-08-27 Partial fix · 3.10.3 CWE-674
TI-2026-56371 CVE-2026-81723 · GHSA-vp2x-qp44-57v7

NLTK before 3.10.3 Quadratic CPU Exhaustion via XMLCorpusView

Priority MEDIUM 61

NLTK versions before 3.10.3 contain a quadratic CPU exhaustion vulnerability in XMLCorpusView._read_xml_fragment() that rescans accumulated XML fragments on every 1 KiB block read.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00281 Published 2026-08-27 Partial fix · 3.10.3 CWE-400
TI-2026-56370 CVE-2026-81722 · GHSA-ww6m-cw3f-q94g

nltk PorterStemmer before 3.10.3 Quadratic-time DoS

Priority HIGH 77

nltk PorterStemmer in versions <= 3.10.2 (fixed in 3.10.3) contains an inefficient-algorithmic-complexity denial of service in PorterStemmer.stem().

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00521 Published 2026-08-27 Partial fix · 3.10.3 CWE-407