—

PYSEC-2026-3739

Quick fix

PYSEC-2026-3739 — nltk: upgrade to the fixed version with the command below.

pip install --upgrade 'nltk>=3.10.3'

Details

NLTK before 3.10.3 contains an uncontrolled recursion vulnerability in nltk.featstruct.FeatStructReader that allows unauthenticated attackers to cause a denial of service by supplying deeply nested feature-structure input. Attackers can craft trivial payloads with nested brackets that exceed Python's recursion limit and raise an unhandled RecursionError, crashing applications that parse user-supplied feature structures or feature grammars.

Are you affected?

Enter the version of the package you're using.

Affected packages

PyPI/nltk

Introduced in: 0Fixed in: 3.10.3

Fixpip install --upgrade 'nltk>=3.10.3'

References

https://www.vulncheck.com/advisories/nltk-before-3.10.3-denial-of-service-via-uncontrolled-recursion[ADVISORY]
https://github.com/nltk/nltk/security/advisories/GHSA-cw6x-m8jw-qmrh[EVIDENCE]