Vulnerability Details CVE-2026-81724
NLTK before 3.10.3 contains an uncontrolled recursion vulnerability in nltk.featstruct.FeatStructReader that allows unauthenticated attackers to cause a denial of service by supplying deeply nested feature-structure input. Attackers can craft trivial payloads with nested brackets that exceed Python's recursion limit and raise an unhandled RecursionError, crashing applications that parse user-supplied feature structures or feature grammars.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.003
EPSS Ranking 17.2%
CVSS Severity
CVSS v3 Score 5.3