Description

NLTK versions before 3.10.3 contain a quadratic CPU exhaustion vulnerability in XMLCorpusView._read_xml_fragment() that rescans accumulated XML fragments on every 1 KiB block read. Attackers can provide malformed XML corpus files to cause severe CPU consumption and denial of service through affected readers like BNCCorpusReader.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.7",
  "pubDate": "2026-08-27T17:21:02.957Z",
  "pubdate": "2026-08-27T17:21:02.957Z",
  "executiveSummary": "NLTK versions prior to 3.10.3 are susceptible to a quadratic complexity vulnerability within the XML processing logic of the XMLCorpusView class. This flaw constitutes a Denial of Service (DoS) condition, allowing an attacker to trigger excessive CPU consumption.\nThe vulnerability manifests during the invocation of the _read_xml_fragment() function, which incorrectly handles buffer accumulation while processing malformed XML corpus files. By supplying a specially crafted XML structure, an attacker can force the reader to perform redundant rescanning operations for every 1 KiB block of data processed.\nThe impact is significant, as it enables resource exhaustion that can lead to application hanging or total service unavailability when processing malicious inputs through affected readers, such as BNCCorpusReader. Exploitation does not require authentication or elevated privileges, provided the attacker can influence the corpus data ingested by the NLTK library. The risk implication is high for systems that utilize NLTK to process untrusted or externally sourced XML-based corpora, as the computational complexity scales quadratically with the size of the input, effectively halting processing threads.\nThis vulnerability highlights a critical failure in algorithmic efficiency during stream-based parsing, necessitating an immediate update to version 3.10.3 or later to remediate the underlying logic error.",
  "technicalDetails": "The root cause of this vulnerability lies in the implementation of the _read_xml_fragment() method within the XMLCorpusView component of the NLTK library. The function is designed to read XML data in discrete chunks of 1 KiB. However, the logic employed to handle these accumulated fragments performs an inefficient re-scanning of the existing buffer each time a new block is appended.\nIn a standard linear parsing scenario, the complexity should ideally be O(n). Due to the improper implementation, the library exhibits O(n^2) time complexity. As the parser progresses through a malformed or sufficiently large XML document, the overhead of re-scanning the growing buffer grows quadratically. Each successive read operation forces the CPU to re-traverse the entire accumulated fragment buffer, leading to a exponential increase in compute cycles required to complete the parsing task.\nThe attack flow begins when an application utilizes an NLTK reader, such as BNCCorpusReader, to parse a corpus file. An attacker provides a malformed XML file designed to trigger this inefficient behavior. When the library begins reading this file, the _read_xml_fragment() function enters a state of repeated rescanning. As the buffer size increases, the execution time for each subsequent 1 KiB block read increases, rapidly exhausting CPU resources.\nThis behavior is particularly detrimental because it does not require complex malformed structures to succeed; simple inputs that leverage the growth of the buffer are sufficient to cause a service outage. Because the function is called during the natural course of corpus reading, the vulnerability is exposed whenever an application processes external data sources. The vulnerability exists within the logic of NLTK library versions before 3.10.3.\nFrom an exploitation standpoint, an attacker requires no authentication or special permissions. The attack is effective as long as the victim's environment is configured to parse the provided corpus. Post-exploitation, the primary impact is a persistent Denial of Service on the process handling the NLTK parsing, which can cause downstream service failures in integrated applications. There is no evidence that this vulnerability allows for arbitrary code execution; it is strictly a resource exhaustion vector based on algorithmic complexity."
}