CVE-2026-81723
Fixed in a distro release EPSS <1%CVSS 3.7
NLTK versions before 3.10.3 contain a quadratic CPU exhaustion vulnerability in XMLCorpusView._read_xml_fragment() that rescans accumulated XML fragments on every 1 KiB block read. Attackers can provide malformed XML corpus files to cause severe CPU consumption and denial of service through affected readers like BNCCorpusReader.
Products: nltk
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| PyPI | nltk | 3.10.3 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | nemo | 2.7.3-r27 |
| Chainguard | open-webui | 0.11.3-r1 |
| Debian 12 | nltk | no fix |
| Debian 13 | nltk | no fix |
| Debian 14 | nltk | 3.10.3-1 |
| Ubuntu Pro 14.04 LTS | nltk | no fix |
| Ubuntu Pro 16.04 LTS | nltk | no fix |
| Ubuntu Pro 18.04 LTS | nltk | no fix |
| Ubuntu Pro 20.04 LTS | nltk | no fix |
| Ubuntu Pro 22.04 LTS | nltk | no fix |
| Ubuntu Pro 24.04 LTS | nltk | no fix |
| Ubuntu Pro 26.04 LTS | nltk | no fix |
| Wolfi | open-webui | 0.11.3-r1 |