Vulnerability · Published Aug 27, 2026 · Assigned by VulnCheck

CVE-2026-81723NLTK before 3.10.3 Quadratic CPU Exhaustion via XMLCorpusView

Low 3.7

In plain English

A low-severity uncontrolled resource consumption in nltk from nltk. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 21% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)3.7Low

Exploit odds (30 days)0.3%top 79.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

NLTK versions before 3.10.3 contain a quadratic CPU exhaustion vulnerability in XMLCorpusView._read_xml_fragment() that rescans accumulated XML fragments on every 1 KiB block read. Attackers can provide malformed XML corpus files to cause severe CPU consumption and denial of service through affected readers like BNCCorpusReader.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:12	nltk	no fix listed	DEBIAN-CVE-2026-81723
Debian:13	nltk	no fix listed	DEBIAN-CVE-2026-81723
Debian:14	nltk	3.10.3-1	DEBIAN-CVE-2026-81723
PyPI	nltk	3.10.3	GHSA-vp2x-qp44-57v7
PyPI	nltk	3.10.3	PYSEC-2026-3871

Affected products (as reported)

Vendor	Product	Versions
nltk	nltk	0 – before 3.10.3

Weakness: CWE-400 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

References

GitHub Security Advisory (GHSA-vp2x-qp44-57v7) vendor-advisory
VulnCheck Advisory: NLTK before 3.10.3 Quadratic CPU Exhaustion via XMLCorpusView third-party-advisory