Technical impact
NLTK versions before 3.9.4 contain an unbounded recursion bug in JSONTaggedDecoder.decode_obj(). Attackers can supply deeply nested JSON structures that exceed Python’s recursion limit, triggering an unhandled RecursionError that crashes the interpreter process. The flaw is classified as CWE‑674, Uncontrolled Recursion, and also exhibits CWE‑606, Missing Input Validation, as the decoder accepts arbitrary nested structures without bounds. The flaw does not provide a privilege escalation path but can completely halt services that depend on NLTK, resulting in a denial of service.
Affected Systems
All users of the Python Natural Language Toolkit (NLTK) prior to release 3.9.4 are affected. The vulnerability applies to any installation where the vulnerable JSONTaggedDecoder is used to parse user‑supplied JSON data.
Risk and Exploitability
The CVSS score of 8.7 indicates a high severity, and the exploit requires the ability to deliver a crafted JSON payload to the NLTK decoder. While the EPSS score is < 1%, the lack of an official KEV listing does not mitigate the risk, as the flaw can be leveraged in any environment exposing the decoding functionality. Remediation is recommended as the threat is active and the potential for service disruption is significant.
Github GHSA