⚠ Withdrawn by GitHub Security Advisories

Withdrawn: November 14, 2026

GHSA-6665-2vj3-h76rHighCVSS 7.5No CVE ID named

Duplicate Advisory: Quadratic-time CPU denial of service in Tree.chomsky_normal_form right-factor binarization via list.pop(0)

Published
November 13, 2026
Last Modified
November 14, 2026

📋 Description

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-r53h-rw34-8h97. This link is maintained to preserve external references.

Original Description

NLTK before 3.10.4 contains a denial of service vulnerability in Tree.chomsky_normal_form that allows remote attackers to exhaust CPU through quadratic-time right-factor binarization using list.pop(0). Attackers can supply a wide flat treebank tree parsed by Tree.fromstring to force tens of seconds of single-threaded CPU consumption, blocking the processing thread.

🎯 Affected products1

  • pip/nltk:< 3.10.4

🔗 References (4)