GHSA-rf74-v2fm-23pw: Natural Language Toolkit (NLTK) has unbounded recursion in JSONTaggedDecoder.decode_obj() may cause DoS
(updated )
JSONTaggedDecoder.decode_obj() in nltk/jsontags.py calls itself
recursively without any depth limit. A deeply nested JSON structure
exceeding sys.getrecursionlimit() (default: 1000) will raise an
unhandled RecursionError, crashing the Python process.
References
- github.com/advisories/GHSA-rf74-v2fm-23pw
- github.com/nltk/nltk/commit/00cdcd392142e6c745e7120c8d50a24127df5fad
- github.com/nltk/nltk/security/advisories/GHSA-rf74-v2fm-23pw
- github.com/pypa/advisory-database/tree/main/vulns/nltk/PYSEC-2026-3724.yaml
- nvd.nist.gov/vuln/detail/CVE-2026-66393
- www.vulncheck.com/advisories/nltk-before-denial-of-service-via-jsontaggeddecoder
Code Behaviors & Features
Detect and mitigate GHSA-rf74-v2fm-23pw with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →