NLTK CVE-2026-81724

Exploitation requires that the target application passes user-controlled input directly to nltk.featstruct.FeatStructReader (or a feature grammar parser that internally invokes it) without enforcing a nesting-depth limit. Applications that use NLTK exclusively for tokenization, tagging, stemming, or other components unrelated to feature structures are NOT affected. The CVSS 4.0 vector (PR:N/UI:N) confirms no authentication or user interaction is required once the parsing endpoint is reachable over the network. Limiting factors include: the application must specifically use the FeatStructReader or feature grammar functionality; the input pathway must be reachable by untrusted users; and the application must not already catch RecursionError exceptions. Deployments where feature-structure parsing is only invoked on internally generated or pre-validated input are not exploitable.

The CVSS 4.0 base score of 6.9 reflects network reachability with no authentication, complexity, or user-interaction barrier, but constrains impact to low vulnerable-system availability (VA:L) with no confidentiality or integrity effect (VC:N/VI:N) and no subsequent-system impact (SC:N/SI:N/SA:N). This scoring is consistent with a purely application-level crash that does not escalate privileges or expose data. No EPSS score was provided in the input data, so exploitation probability cannot be quantified numerically. The absence of a CISA KEV listing and the lack of identified public exploit code further support treating this as a lower-urgency issue compared to actively weaponized CVEs. Real-world exploitability is conditional: only applications that expose NLTK feature-structure parsing to untrusted external input are reachable, which limits the realistic attacker population considerably. The vulnerability is trivially exploitable once the attack surface is confirmed - crafting a deeply nested payload requires no special knowledge - but finding and targeting vulnerable deployments requires identifying NLP-specific endpoints, reducing opportunistic risk. Overall, this warrants prompt patching in any deployment that accepts external feature grammar input, but does not require emergency incident response for offline or authenticated-only pipelines.

An attacker submits a crafted string such as [f1=[f2=[f3=[...]]]] with hundreds or thousands of nested bracket levels to any HTTP endpoint or input field that passes the value to nltk.featstruct.FeatStructReader. The parser recurses without a depth guard, rapidly exceeding Python's recursion limit, and the resulting unhandled RecursionError terminates the worker process or application thread. If the application does not restart workers automatically, this constitutes persistent denial of service achievable with a single small request.