### Impact
An attacker who uses this vulnerability can craft a PDF which leads to long runtimes and large memory consumption. This requires accessing the outlines of a document with either lots of entries or nested outlines with long re-used nesting paths.
### Patches
This has been fixed in [pypdf==6.16.1](https://github.com/py-pdf/pypdf/releases/tag/6.16.1).
### Workarounds
If you cannot upgrade yet, consider applying the changes from PR [#3966](https://github.com/py-pdf/pypdf/pull/3966).
### Impact
An attacker who uses this vulnerability can craft a PDF which leads to long runtimes and large memory consumption. This requires extracting the text of a page with lots of XForm objects, where some of them might be re-used.
### Patches
This has been fixed in [pypdf==6.16.1](https://github.com/py-pdf/pypdf/releases/tag/6.16.1).
### Workarounds
If you cannot upgrade yet, consider applying the changes from PR [#3966](https://github.com/py-pdf/pypdf/pull/3966).
NLTK contains a file sandbox bypass vulnerability in several model-artifact APIs that improperly handle caller-controlled model paths. Despite path security enforcement via pathsec, these APIs use raw file operations allowing reading and writing files outside the allowed sandbox roots. This affects model import and export functions such as TransitionParser.train, TransitionParser.parse, and AveragedPerceptron.save/load. The issue is confirmed in versions 3.9.4 and 3.10.0-rc2, with a fix available in version 1.0.8_25. Exploiting this flaw can lead to unauthorized file access and modification outside intended directories.
NLTK's corpus-reader constructors, specifically LinThesaurusCorpusReader and PanLexLiteCorpusReader, can bypass the nltk.pathsec sandbox designed to restrict file and database access. This allows these readers to perform file and database reads outside the intended sandbox root even when sandbox enforcement is enabled. The vulnerability arises because the CorpusReader.__init__ method converts the root path to a FileSystemPathPointer without applying pathsec validation, and subsequent file/database operations use builtin open() or sqlite3.connect() directly, bypassing sandbox controls.
Several corpus readers in NLTK (Natural Language Toolkit) improperly handle symlinked files, allowing path traversal and symlink boundary bypass. These readers reopen paths derived from trusted roots using raw open() calls instead of the symlink-aware nltk.pathsec.open(), enabling attackers to disclose files outside the trusted corpus root. The issue affects specific readers such as ipipan, crubadan, and lin in versions 3.9.4 and 3.10.0-rc2. A fix is available that enforces path validation and trusted-root boundaries end to end.
NLTK's Text.findall() and TokenSearcher.findall() methods in the nltk.text module accept user-supplied regular expressions without validation or timeout, leading to a Regular Expression Denial of Service (ReDoS) vulnerability. This allows an unauthenticated attacker to cause indefinite CPU saturation by exploiting catastrophic backtracking in the regex engine. The issue was fixed in a prior commit.
The NLTK tgrep module suffers from a Regular Expression Denial of Service (ReDoS) vulnerability due to unvalidated user-supplied regex patterns compiled without timeout. This allows an attacker to cause catastrophic backtracking, leading to indefinite CPU consumption and denial of service in applications exposing the tgrep API to external input. The vulnerability affects NLTK versions up to 3.10.2 and has been confirmed with proof-of-concept code demonstrating exponential runtime growth. A patch is available to mitigate this issue.
The NLTK PorterStemmer's stem() function has a quadratic-time denial-of-service vulnerability triggered by tokens containing long runs of the letter 'y'. This causes excessive CPU consumption when processing such tokens, impacting availability but not confidentiality or integrity. The issue arises from an iterative function that repeatedly walks backward over runs of 'y's, resulting in O(n^2) complexity. A fix is available to optimize this to linear time.
A denial of service vulnerability exists in the NLTK library's FeatStructReader parser due to uncontrolled recursion when processing deeply nested feature-structure strings. The parser lacks a maximum recursion depth limit, causing Python's RecursionError to be raised and crash applications that parse untrusted input. This affects NLP tools and pipelines using FeatStruct or FeatureGrammar.fromstring(). The issue is not related to memory safety or code execution but results in application crashes. A patch is available to address this issue.
The Pl196xCorpusReader component in the gptline product has a Regular Expression Denial of Service (ReDoS) vulnerability (CVE-2026-81725) caused by quadratic CPU growth when parsing malformed TEI blocks with many unmatched opening tags. This affects versions from 1.0.8 up to but not including 1.0.8_23. The vulnerability arises from lazy regex patterns that repeatedly rescan attacker-controlled text, leading to excessive CPU consumption and potential parser thread stalling. No official patch is currently available, but a fix involving replacing the regex parser with a linear parser or bounded tokenizer is recommended.
NLTK's downloader component has a filesystem containment bypass vulnerability where it fails to treat pre-existing hardlinks inside the install tree as unsafe. This allows an attacker with write access to the downloader root on the same filesystem to overwrite files outside the intended installation directory by exploiting hardlinks. The issue affects versions 3.9.4 and 3.10.0-rc2 and is fixed in version 3.10.3.
NLTK's pathsec module contains a server-side request forgery (SSRF) vulnerability in proxied environments. The vulnerability arises because when an HTTP proxy is configured, the hostname validation performed by pathsec.urlopen() is bypassed, allowing requests to internal-only services via the proxy. This affects functions like nltk.data.load and nltk.downloader.Downloader methods. The issue is present in NLTK version 3.10.0-rc2 and not reproducible in 3.9.4. A fix has been implemented that blocks proxied fetches unless explicitly opted into, preventing unvalidated proxied requests.
The NLTK library's TransitionParser.parse() method insecurely deserializes model files using pickle without restricting class resolution, allowing remote code execution (RCE) via malicious pickle files. Although NLTK provides a RestrictedUnpickler for safe deserialization, it is not used in production code paths, leaving versions up to 3.9.4 vulnerable. This vulnerability enables attackers to execute arbitrary code with the privileges of the user running the application. The issue is fixed in NLTK version 3.10.0 and later by enforcing restricted unpickling.
NLTK versions from 1.0.8 up to but not including 1.0.8_23 contain a denial-of-service vulnerability due to unsafe XML entity expansion in several XML parsing functions that use Python's xml.etree.ElementTree directly. Crafted XML documents with nested entity declarations can cause exponential memory amplification (billion laughs attack), leading to high memory consumption and potential service disruption. The vulnerability is mitigated by routing XML parsing through a new nltk.xmlsec module that forbids entity declarations, using defusedxml or a fallback expat pre-scan. A patch is available to address this issue.
CVE-2026-79657 is a critical remote code execution vulnerability in the Natural Language Toolkit (NLTK) library's allowlisted pickle loaders. The vulnerability arises because the allowlist trusts entire module namespaces rather than specific safe globals, allowing crafted pickle payloads to invoke dangerous callables during deserialization. This affects functions such as nltk.picklesec.allowlisted_pickle_load, nltk.tokenize.punkt.punkt_pickle_load, and nltk.parse.transitionparser.TransitionParser.parse in versions before 3.10.3. The flaw permits attackers to execute arbitrary commands when loading attacker-controlled tokenizer or model artifacts, defeating the intended safety mechanism. A patch is available that tightens the allowlist to exact (module, qualname) pairs and denies dangerous modules, effectively blocking these exploits.
CVE-2026-79675 is a critical vulnerability in the NLTK Stanford Java wrappers where JVM argument injection can bypass the previous fix for CVE-2026-12841. The vulnerability arises because the per-call java() function accepts unvalidated JVM options, allowing dangerous flags to be passed directly to the JVM. This affects four Stanford wrapper classes that accept user-supplied java_options without validation. Exploitation could allow arbitrary code execution via malicious JVM flags. A patch is available that adds validation to the per-call options path.
NLTK versions up to 3.10.2 contain a vulnerability where the Graphviz 'dot' binary is invoked by its bare name without validating its absolute path. This allows an attacker who can place a malicious 'dot' executable in the current working directory or a writable directory on the PATH to execute arbitrary code. The issue affects the functions nltk.parse.dependencygraph.dot2img and nltk.translate.api.AlignedSent._repr_svg_. The vulnerability has been fixed by ensuring that the validated absolute path returned by nltk.internals.find_binary is used instead of the bare binary name.
CVE-2026-82398 is an inefficient algorithmic complexity vulnerability in the py-pdf pypdf library. An attacker can craft a specially designed PDF that triggers long runtimes by causing the function read_until_whitespace to process input lacking whitespace for an extended period. This can lead to performance degradation when parsing such PDFs. The issue has been fixed in pypdf version 6.15.0. Users unable to upgrade immediately may apply the changes from pull request #3947 as a workaround.
Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.8, Tornado parses application/x-www-form-urlencoded request bodies with urllib.parse.parse_qs in tornado/escape.py without passing max_num_fields. RequestHandler._execute in tornado/web.py parses the body before handler dispatch through HTTPServerRequest._parse_body and parse_body_arguments in tornado/httputil.py, so an unauthenticated request body containing millions of separator-delimited fields can synchronously stall the single-threaded event loop and delay every connection. The body is bounded only by max_buffer_size, which defaults to 104857600 bytes. This issue is fixed in version 6.5.8.