The vulnerability arises from uncontrolled recursion in NLTK's FeatStructReader. An attacker can deliver input that includes deeply nested brackets, exceeding Python's recursion limit and causing a RecursionError. This error propagates without handling, forcing the application to crash and resulting in a denial of service.

NLTK versions earlier than 3.10.3 are affected. The issue lives in the nltk library, so any application that imports nltk and uses FeatStructReader, such as parsers or grammars that consume user‑supplied feature‑structure data, may be impacted. The affected vendor is the NLTK project.

The CVSS score of 6.9 indicates moderate severity. The EPSS score of <1% suggests a very low probability of exploitation in the wild. The vulnerability is not listed in CISA’s KEV catalog. Because any user can supply malformed input, the attack is remote with no authentication required. Exploitation requires only that the target application process feature‑structure input; if the application invokes FeatStructReader, the attacker’s crafted payload will cause a RecursionError and crash the process. The result is a denial of service that can affect availability of the application or associated services.