Snyk Security Database

fund-portfolio is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship.

nltk is a Natural Language Toolkit (NLTK) is a Python package for natural language processing.

Affected versions of this package are vulnerable to Resources Downloaded over Insecure Protocol via the downloader. An attacker can execute arbitrary code and compromise system integrity by injecting malicious package contents during a man-in-the-middle attack or DNS poisoning, which are then extracted without validation.

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the contextWithBaggage parsing path in io.micrometer.tracing.brave.bridge.W3CPropagation. An attacker can exhaust CPU and heap by sending a request with a W3C baggage header containing an excessive number of key-value pairs or an oversized header, which the extractor parses without bounding the input. The vulnerable code allocates baggage objects for each parsed entry from untrusted headers, creating garbage-collection pressure and high CPU usage during request processing. In affected applications that accept attacker-controlled baggage headers, this can trigger OutOfMemoryError and crash the service.

Notes

• Additional fixes are available for earlier versions under Enterprise Support (see the Spring Security Advisory for additional details)