CVE-2026-66393

NLTK versions before 3.9.4 contain an unbounded recursion vulnerability in JSONTaggedDecoder.decode_obj() that allows attackers to cause denial of service by supplying deeply nested JSON structures. Attackers can craft JSON payloads exceeding the recursion limit to trigger an unhandled RecursionError that crashes the Python process.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/nltk/nltk/security/advisories/GHSA-rf74-v2fm-23pw	Exploit Mitigation Vendor Advisory
https://www.vulncheck.com/advisories/nltk-before-denial-of-service-via-jsontaggeddecoder	Third Party Advisory
https://github.com/nltk/nltk/security/advisories/GHSA-rf74-v2fm-23pw	Exploit Mitigation Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:nltk:nltk:*:*:*:*:*:*:*:*

History

14 Oct 2026, 13:10

Type	Values Removed	Values Added
Summary		(es) Versiones de NLTK anteriores a la 3.9.4 contienen una vulnerabilidad de recursión ilimitada en JSONTaggedDecoder.decode_obj() que permite a los atacantes causar denegación de servicio al proporcionar estructuras JSON profundamente anidadas. Los atacantes pueden crear cargas útiles JSON que exceden el límite de recursión para desencadenar un RecursionError no manejado que bloquea el proceso de Python.

Information

Published : 2026-08-22 15:16

Updated : 2026-10-14 13:10

NVD link : CVE-2026-66393

Mitre link : CVE-2026-66393

CVE.ORG link : CVE-2026-66393

JSON object : View

Products Affected

nltk

nltk

CWE

CWE-674

Uncontrolled Recursion

{"id": "CVE-2026-66393", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-66393", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-26T17:54:42.004486Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.7, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"vendor": "nltk", "product": "nltk", "versions": [{"status": "affected", "version": "0", "lessThan": "3.9.4", "versionType": "semver"}, {"status": "unaffected", "version": "3.9.4", "versionType": "semver"}], "packageURL": "pkg:pypi/nltk", "defaultStatus": "unaffected"}]}], "published": "2026-08-22T15:16:19.633", "references": [{"url": "https://github.com/nltk/nltk/security/advisories/GHSA-rf74-v2fm-23pw", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/nltk-before-denial-of-service-via-jsontaggeddecoder", "tags": ["Third Party Advisory"], "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/nltk/nltk/security/advisories/GHSA-rf74-v2fm-23pw", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-674"}]}], "descriptions": [{"lang": "en", "value": "NLTK versions before 3.9.4 contain an unbounded recursion vulnerability in JSONTaggedDecoder.decode_obj() that allows attackers to cause denial of service by supplying deeply nested JSON structures. Attackers can craft JSON payloads exceeding the recursion limit to trigger an unhandled RecursionError that crashes the Python process."}, {"lang": "es", "value": "Versiones de NLTK anteriores a la 3.9.4 contienen una vulnerabilidad de recursi\u00f3n ilimitada en JSONTaggedDecoder.decode_obj() que permite a los atacantes causar denegaci\u00f3n de servicio al proporcionar estructuras JSON profundamente anidadas. Los atacantes pueden crear cargas \u00fatiles JSON que exceden el l\u00edmite de recursi\u00f3n para desencadenar un RecursionError no manejado que bloquea el proceso de Python."}], "lastModified": "2026-10-14T13:10:00.187", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:nltk:nltk:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A5471378-2B80-492B-B6BC-E6E9AE4F5179", "versionEndExcluding": "3.9.4"}], "operator": "OR"}]}], "sourceIdentifier": "disclosure@vulncheck.com"}