CVE-2026-66393CWE-674

CVE-2026-66393

High · published August 22, 2026

CVSS v3.1

7.5

EPSS

Percentile

43.4

In the wild

Unconfirmed

What it is

NLTK versions before 3.9.4 contain an unbounded recursion vulnerability in JSONTaggedDecoder.decode_obj() that allows attackers to cause denial of service by supplying deeply nested JSON structures. Attackers can craft JSON payloads exceeding the recursion limit to trigger an unhandled RecursionError that crashes the Python process.

The record

Technical detail

CVSS v3.1: 7.5 · HIGH
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0: 8.7 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
EPSS: 0.00521 · 43.4th percentile
Weakness: CWE-674 · Uncontrolled Recursion
Published: 2026-08-22T19:16Z

Affected products (1)

Product	Versions	Fixed in
nltk/nltk	< 3.9.4	3.9.4

References (3)

https://github.com/nltk/nltk/security/advisories/GHSA-rf74-v2fm-23pw · [email protected]https://www.vulncheck.com/advisories/nltk-before-denial-of-service-via-jsontaggeddecoder · [email protected]https://github.com/nltk/nltk/security/advisories/GHSA-rf74-v2fm-23pw · 134c704f-9b21-4f2e-91b3-4a467353bcc0

EPSS history

Timeline

22 AUG 14:12Z
NLTK before 3.9.4 Denial of Service via JSONTaggedDecoder
cvelistv5