Description (CNA)
NLTK versions before 3.10.3 contain a quadratic CPU exhaustion vulnerability in XMLCorpusView._read_xml_fragment() that rescans accumulated XML fragments on every 1 KiB block read. Attackers can provide malformed XML corpus files to cause severe CPU consumption and denial of service through affected readers like BNCCorpusReader.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| nltk / nltk | affected 0 before 3.10.3; unaffected 3.10.3 |
CWE
CWE-400
References
- https://github.com/nltk/nltk/security/advisories/GHSA-vp2x-qp44-57v7
- https://www.vulncheck.com/advisories/nltk-before-3.10.3-quadratic-cpu-exhaustion-via-xmlcorpusview
ADP enrichment
No English description supplied.