CVE-2026-66393highCWE-674

CVE-2026-66393: high-severity vulnerability in nltk

NLTK before 3.9.4 Denial of Service via JSONTaggedDecoder

Published · Updated

Follow this CVE+ Monitor nltk+ Monitor nltk

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 8.7epss 0.5%
NLTK versions before 3.9.4 contain an unbounded recursion vulnerability in JSONTaggedDecoder.decode_obj() that allows attackers to cause denial of service by supplying deeply nested JSON structures. Attackers can craft JSON payloads exceeding the recursion limit to trigger an unhandled RecursionError that crashes the Python process.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Affected products
nltk · nltk
Related CVEs — nltk

In the same product, most dangerous first.

CVE-2021-43854HIGHInefficient Regular Expression Complexity in nltkEPSS 2.8%CVE-2026-79657CRITICALNLTK before 3.10.3 Remote Code Execution via Unsafe Pickle DeserializationEPSS 1.3%CVE-2026-33231HIGHNLTK has unauthenticated remote shutdown in nltk.app.wordnet_appEPSS 1.2%CVE-2026-71513HIGHNLTK 3.10.0 through 3.10.2 Remote Code Execution via AllowlistUnpickler Dotted-Name BypassEPSS 1.1%CVE-2026-79675CRITICALNLTK before 3.10.3 JVM Argument Injection via Per-Call OptionsEPSS 0.8%CVE-2026-72818HIGHNLTK TweetTokenizer URL Pattern Backtracks Catastrophically on Naked-Domain-Like InputEPSS 0.7%