⚠ Withdrawn by GitHub Security Advisories

Withdrawn: November 13, 2026

GHSA-rg32-vgf9-927cMediumCVSS 5.3No CVE ID named

Duplicate Advisory: Quadratic CPU exhaustion in TreebankWordTokenizer.span_tokenize via list.pop(0) in quote-restore loop

Published
November 13, 2026
Last Modified
November 13, 2026

📋 Description

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-ffr9-mgrr-wcvr. This link is maintained to preserve external references.

Original Description

NLTK from 3.2.5 before 3.10.4 contains an algorithmic complexity vulnerability in TreebankWordTokenizer.span_tokenize that allows remote attackers to cause quadratic CPU consumption through repeated list.pop(0) calls. Attackers can submit long runs of double-quote characters to services span-tokenizing untrusted text, exhausting a CPU core and degrading availability.

🎯 Affected products1

  • pip/nltk:< 3.10.4

🔗 References (4)