Threats tagged 'brew-acronym-cve-2026-81723'

NLTK's XMLCorpusView._read_xml_fragment() function exhibits quadratic CPU exhaustion when processing malformed XML corpus files. The function reads the file in 1 KiB blocks, appending to a growing buffer and rescanning the entire buffer each iteration with a regular expression match. This causes CPU usage to grow quadratically with input size, leading to potential denial of service. The issue affects multiple corpus readers relying on XMLCorpusView, including BNCCorpusReader. Verified in NLTK versions 3.9.4, 3.10.0, and current development, with a fix available in version 2.0.0_5. The vulnerability has a low CVSS score and no known exploits in the wild.