Uncontrolled Recursion Affecting nltk package, versions [,3.10.3)

nltk is a Natural Language Toolkit (NLTK) is a Python package for natural language processing.

Affected versions of this package are vulnerable to Uncontrolled Recursion via the RecursiveDescentParser in nltk/parse/recursivedescent.py. An attacker can pin a CPU core indefinitely or exhaust the Python recursion stack by supplying a tiny left-recursive or highly ambiguous grammar and triggering top-down parsing on even a short input. The parser enumerates parse trees recursively with no default bound on the search, so crafted grammars cause unbounded work and hang the process. This can deny service to applications that parse untrusted grammars or user-controlled input with RecursiveDescentParser or SteppingRecursiveDescentParser.

• GitHub Commit
• GitHub PR
• Maintainer's Advisory