VULNERABILITY INTELLIGENCE

CVE-2026-66393

CVSS score7.5 HIGH
EPSS probability0.52%
CISA KEVNot currently listed
Published2026-08-22
Last modified2026-10-14
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Description

NLTK versions before 3.9.4 contain an unbounded recursion vulnerability in JSONTaggedDecoder.decode_obj() that allows attackers to cause denial of service by supplying deeply nested JSON structures. Attackers can craft JSON payloads exceeding the recursion limit to trigger an unhandled RecursionError that crashes the Python process.

Weakness classification

  • disclosure@vulncheck.com: CWE-674

Primary references