6.3

GHSA-HQV3-XM29-P9HQ: nltk PyPI

CVSS: 6.3v4.0MediumPublished
Published 27-08-2026Last modified 10-09-2026
Open JSON

Vulnerability summary

GHSA-HQV3-XM29-P9HQ is a medium (CVSS 6.3) vulnerability in nltk PyPI.

Overall risk
25/100
0100
Medium · default modelHow is this calculated?
CVSS score
6.3/10
010
Medium · v4.0 (OSV · Pypi), selected by version preference
EPSS score
Not scored
0%100%
No EPSS score yet
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 1 · Related 1
CVE-2026-81723CGA-6672-5565-7WF6

Timeline

  1. 27-08-2026
    PublishedVulnerability first disclosed.
  2. 10-09-2026
    Last modifiedVulnerability information updated.

Description

Duplicate Advisory: Quadratic CPU Exhaustion in `XMLCorpusView._read_xml_fragment()` ## Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-vp2x-qp44-57v7. This link is maintained to preserve external references. ## Original Description NLTK versions before 3.10.3 contain a quadratic CPU exhaustion vulnerability in XMLCorpusView._read_xml_fragment() that rescans accumulated XML fragments on every 1 KiB block read. Attackers can provide malformed XML corpus files to cause severe CPU consumption and denial of service through affected readers like BNCCorpusReader.

CVSS metrics

2 scores · 1 source · 2 versions

EPSS trend

No EPSS score has been published for this record yet.

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

No weakness data has been published for this record.

Affected systems

PyPI1 product
  • nltk≤ 3.10.2

1 vendor · 1 product

References

3 links