What is GHSA-hqv3-xm29-p9hq?

GHSA-hqv3-xm29-p9hq is a security advisory published by GitHub Security Advisories with Medium severity. NLTK versions before 3.10.3 contain a quadratic CPU exhaustion vulnerability in XMLCorpusView...

Which CVE IDs does GHSA-hqv3-xm29-p9hq cover?

GHSA-hqv3-xm29-p9hq covers the following CVE IDs: CVE-2026-81723. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-hqv3-xm29-p9hq?

GHSA-hqv3-xm29-p9hq has a CVSS v3 base score of 3.7, published by GitHub Security Advisories.

GHSA-hqv3-xm29-p9hqMediumCVSS 3.7

NLTK versions before 3.10.3 contain a quadratic CPU exhaustion vulnerability in XMLCorpusView...

Vendor

GitHub Security Advisories

Published

August 27, 2026

Last Modified

August 27, 2026

🔗 CVE IDs covered (1)

CVE-2026-81723 →

📋 Description

NLTK versions before 3.10.3 contain a quadratic CPU exhaustion vulnerability in XMLCorpusView._read_xml_fragment() that rescans accumulated XML fragments on every 1 KiB block read. Attackers can provide malformed XML corpus files to cause severe CPU consumption and denial of service through affected readers like BNCCorpusReader.

🔗 References (4)

https://github.com/nltk/nltk/security/advisories/GHSA-vp2x-qp44-57v7
https://nvd.nist.gov/vuln/detail/CVE-2026-81723
https://www.vulncheck.com/advisories/nltk-before-3.10.3-quadratic-cpu-exhaustion-via-xmlcorpusview
https://github.com/advisories/GHSA-hqv3-xm29-p9hq