CVE-2026-81723CWE-400denial-of-service

CVE-2026-81723

Low · published August 27, 2026

CVSS v3.1
3.7
EPSS
0%
Percentile
19.5
In the wild
Unconfirmed
What it is

NLTK versions before 3.10.3 contain a quadratic CPU exhaustion vulnerability in XMLCorpusView._read_xml_fragment() that rescans accumulated XML fragments on every 1 KiB block read. Attackers can provide malformed XML corpus files to cause severe CPU consumption and denial of service through affected readers like BNCCorpusReader.

The record
Technical detail
CVSS v3.1
3.7 · LOW
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
CVSS v4.0
6.3 · CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
EPSS
0.00281 · 19.5th percentile
Weakness
CWE-400 · Uncontrolled Resource Consumption
Published
2026-08-27T21:21Z
References (3)
https://github.com/nltk/nltk/security/advisories/GHSA-vp2x-qp44-57v7 · [email protected]https://www.vulncheck.com/advisories/nltk-before-3.10.3-quadratic-cpu-exhaustion-via-xmlcorpusview · [email protected]https://github.com/nltk/nltk/security/advisories/GHSA-vp2x-qp44-57v7 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 27 AUG 14:51Z
    NLTK before 3.10.3 Quadratic CPU Exhaustion via XMLCorpusView
    cvelistv5