NLTK before 3.10.3 contains an uncontrolled recursion vulnerability in nltk.featstruct.FeatStructReader that allows unauthenticated attackers to cause a denial of service by supplying deeply nested feature-structure input. Attackers can craft trivial payloads with nested brackets that exceed Pythons recursion limit and raise an unhandled RecursionError, crashing applications that parse user-supplied feature structures or feature grammars.
Weakness
The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Nltk | Nltk | * | 3.10.3 (excluding) |
| Red Hat OpenShift AI 3.5 | RedHat | rhoai/odh-ta-lmes-job-rhel9:1788935863 | * |
| Nltk | Ubuntu | upstream | * |