⚠ Withdrawn by GitHub Security Advisories

Withdrawn: November 14, 2026

GHSA-qvhx-rvgc-jhwfHighCVSS 7.5No CVE ID named

Duplicate Advisory: Quadratic-time CPU denial of service in ConllCorpusReader SRL instance builder via nested span rescan

Published
November 13, 2026
Last Modified
November 14, 2026

📋 Description

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-v8f3-6phw-6mh9. This link is maintained to preserve external references.

Original Description

NLTK before 3.10.4 contains a quadratic-time denial of service vulnerability in ConllCorpusReader._get_srl_instances that allows remote attackers to exhaust CPU through nested span rescans. Attackers can supply a crafted CoNLL SRL corpus with many predicates and span columns, placing the head span last, to pin a core for minutes.

🎯 Affected products1

  • pip/nltk:< 3.10.4

🔗 References (4)