CVE-2026-66393
NLTK before 3.9.4 Denial of Service via JSONTaggedDecoder
- State
- Published
- Severity
- 8.7 High
- Published
- Aug 22, 2026
- Updated
- Aug 26, 2026
- Reserved
- Jul 26, 2026
Description
NLTK versions before 3.9.4 contain an unbounded recursion vulnerability in JSONTaggedDecoder.decode_obj() that allows attackers to cause denial of service by supplying deeply nested JSON structures. Attackers can craft JSON payloads exceeding the recursion limit to trigger an unhandled RecursionError that crashes the Python process.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 8.7 High | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 7.5 High | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | VulnCheck |
Weaknesses
- CWE-674 Uncontrolled Recursion
Affected Products
| Product | Versions |
|---|---|
nltknltk |
|
References
- GitHub Security Advisory (GHSA-rf74-v2fm-23pw)vendor-advisory
- VulnCheck Advisory: NLTK before 3.9.4 Denial of Service via JSONTaggedDecoderthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.