The vulnerability is a quadratic CPU consumption flaw in the NLTK library’s XMLCorpusView._read_xml_fragment() method, which rescans accumulated XML fragments whenever a 1 KiB block is read. A malicious XML corpus file can trigger CPU usage that grows roughly with the square of the file size, exhausting system resources and causing a denial‑of‑service condition. This issue is classified as CWE‑400 Resource Exhaustion and CWE‑776.

The affected product is the Python Natural Language Toolkit (NLTK) distributed as the nltk package. All releases prior to version 3.10.3 are vulnerable; the flaw manifests when an XMLCorpusView reader such as BNCCorpusReader processes XML corpus files. Any application that loads XML corpora with NLTK before 3.10.3 is at risk.

The CVSS score of 6.3 indicates moderate severity. EPSS score of <1% indicates a low probability of exploitation, but exploitation is still possible, and the vulnerability is not listed in CISA’s KEV catalog. An attacker can supply a specially crafted XML corpus file; local or remote code that parses XML corpora could be abused to trigger the excessive CPU use. If a service continuously processes untrusted XML corpora, it could be taken down, affecting availability but not confidentiality or integrity.