Threats tagged 'ghsa-89p3-fcch-88ph'

NLTK's CCG lexicon parser function fromstring suffers from a quadratic-time CPU denial of service vulnerability when parsing specially crafted wide bracket bodies or long operator chains. This flaw allows an attacker to cause sustained single-threaded CPU exhaustion by providing a few-megabyte lexicon string, leading to significant availability loss. The vulnerability arises from inefficient string slicing operations in pure-Python loops that scale quadratically with input size. No authentication or user interaction is required, and the vulnerability affects versions prior to 3.10.4. A fix is available in version 3.10.4.