Description

NLTK versions before 3.9.4 contain an unbounded recursion vulnerability in JSONTaggedDecoder.decode_obj() that allows attackers to cause denial of service by supplying deeply nested JSON structures. Attackers can craft JSON payloads exceeding the recursion limit to trigger an unhandled RecursionError that crashes the Python process.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-22T15:16:19.633Z",
  "pubdate": "2026-08-22T15:16:19.633Z",
  "executiveSummary": "An unbounded recursion vulnerability exists in the JSONTaggedDecoder.decode_obj() function within NLTK versions prior to 3.9.4. This vulnerability is classified as a denial of service flaw driven by uncontrolled resource consumption.\nThe primary impact of this security deficiency is the termination of the host Python process, leading to service disruption and potential application unavailability. The affected systems are any applications utilizing vulnerable versions of the NLTK library to parse untrusted or externally sourced JSON payloads.\nThe risk implications involve application-level availability degradation, as unhandled exceptions in critical parsing pipelines propagate and crash the runtime environment. Threat actors require the capability to supply crafted input data to the decoding routine, but do not necessarily require prior authentication or elevated privileges depending on the integration context of the parsing functionality within the target application.\nExploitation requirements are minimal, relying entirely on the ingestion of a maliciously crafted, deeply nested JSON payload that exceeds the maximum Python recursion depth during evaluation by the vulnerable decoding mechanism.",
  "technicalDetails": "The root cause of the vulnerability resides in the recursive implementation of the JSONTaggedDecoder.decode_obj() function within the NLTK library. When processing structured JSON inputs, the decoding logic recursively traverses nested objects and data structures without enforcing a strict depth threshold or employing an iterative traversal mechanism.\nThe vulnerable component is explicitly identified as the JSONTaggedDecoder.decode_obj() function parsing engine in NLTK versions before 3.9.4. The affected versions lack input sanitization or depth-tracking parameters that would otherwise prevent the call stack from expanding indefinitely when processing excessively nested data.\nThe attack flow begins when an unauthenticated adversary submits a maliciously crafted JSON payload characterized by an extreme level of structural nesting. This payload is subsequently passed to the NLTK decoding pipeline for evaluation. As JSONTaggedDecoder.decode_obj() recursively processes each hierarchical level of the JSON structure, it continuously pushes new stack frames onto the execution stack.\nBecause the nesting depth significantly exceeds the default recursion limit imposed by the Python interpreter, the recursive calls exhaust the remaining stack space. This execution pattern ultimately triggers a deep internal RecursionError within the Python runtime environment. Since the exception handling within the decoding routine fails to catch or gracefully recover from this specific error condition, the exception propagates unhandled to the top level of the process.\nThe payload behavior manifests as immediate termination of the host Python process, resulting in a complete denial of service for any dependent services relying on the affected NLTK functionality. No specific network exposure vectors are inherently defined by the library itself, but applications exposing endpoints that ingest arbitrary JSON data for NLTK processing inherit this attack surface directly.\nPost-exploitation impact is strictly limited to availability disruption; the vulnerability does not facilitate remote code execution, arbitrary file access, or privilege escalation. However, repeated triggering of this crash condition can maintain a persistent denial of service state against the hosting application."
}