PyPI/nltk CVE-2026-81724: medium 5.3, EPSS 0.46%

NLTK before 3.10.3 contains an uncontrolled recursion vulnerability in nltk.featstruct.FeatStructReader that allows unauthenticated attackers to cause a denial of service by supplying deeply nested fe

Action: Upgrade nltk to 3.10.3 or later.

pip install nltk==3.10.3

Affected

Fixed versions

Sources

• osv: PYSEC-2026-3739
• nvd: CVE-2026-81724
• https://www.vulncheck.com/advisories/nltk-before-3.10.3-denial-of-service-via-uncontrolled-recursion
• https://github.com/nltk/nltk/security/advisories/GHSA-cw6x-m8jw-qmrh

CVE-2026-81724 · published 2026-08-27T17:21:03.100Z · modified 2026-09-01T09:15:03.464962431Z · JSON