GHSA-rf74-v2fm-23pw

Опубликовано: 18 мар. 2026

Источник: github

Github: Прошло ревью

CVSS4: 5.1

Описание

Natural Language Toolkit (NLTK) has unbounded recursion in JSONTaggedDecoder.decode_obj() may cause DoS

Summary

JSONTaggedDecoder.decode_obj() in nltk/jsontags.py calls itself recursively without any depth limit. A deeply nested JSON structure exceeding sys.getrecursionlimit() (default: 1000) will raise an unhandled RecursionError, crashing the Python process.

Affected code

File: nltk/jsontags.py, lines 47–52

@classmethod def decode_obj(cls, obj): if isinstance(obj, dict): obj = {key: cls.decode_obj(val) for (key, val) in obj.items()} elif isinstance(obj, list): obj = list(cls.decode_obj(val) for val in obj)

Proof of Concept

import sys, json from nltk.jsontags import JSONTaggedDecoder depth = sys.getrecursionlimit() + 50 # e.g. 1050 payload = '{"x":' * depth + "null" + "}" * depth # Raises RecursionError, crashing the process json.loads(payload, cls=JSONTaggedDecoder)

Impact

Any code path that passes externally-supplied JSON to JSONTaggedDecoder is vulnerable to denial of service. The severity depends on whether such a path exists in the calling code (e.g. nltk/data.py).

Suggested Fix

Add a depth parameter with a hard limit:

@classmethod def decode_obj(cls, obj, _depth=0): if _depth > 100: raise ValueError("JSON nesting too deep") if isinstance(obj, dict): obj = {key: cls.decode_obj(val, _depth + 1) for (key, val) in obj.items()} elif isinstance(obj, list): obj = list(cls.decode_obj(val, _depth + 1) for val in obj)

Ссылки

Пакеты

Наименование

nltk

pip

Затронутые версииВерсия исправления

<= 3.9.3

3.9.4

EPSS

Процентиль: 30%

0.00363

Низкий

5.1 Medium

CVSS4

CVE ID

CVE-2026-66393

Дефекты

CWE-674

Связанные уязвимости

CVE-2026-66393

CVSS3: 7.5

ubuntu

29 дней назад

NLTK versions before 3.9.4 contain an unbounded recursion vulnerability in JSONTaggedDecoder.decode_obj() that allows attackers to cause denial of service by supplying deeply nested JSON structures. Attackers can craft JSON payloads exceeding the recursion limit to trigger an unhandled RecursionError that crashes the Python process.

CVE-2026-66393

CVSS3: 7.5

redhat

29 дней назад

CVE-2026-66393

CVSS3: 7.5

nvd

29 дней назад

CVE-2026-66393

CVSS3: 7.5

debian

29 дней назад

NLTK versions before 3.9.4 contain an unbounded recursion vulnerabilit ...

BDU:2026-13471

CVSS3: 7.5

fstec

6 месяцев назад

Уязвимость функции JSONTaggedDecoder.decode_obj() пакета библиотек для символьной и статистической обработки естественного языка NLTK, позволяющая нарушителю вызвать отказ в обслуживании

EPSS

Процентиль: 30%

0.00363

Низкий

5.1 Medium

CVSS4

CVE ID

CVE-2026-66393

Дефекты

CWE-674