Threats tagged 'ghsa-8fx7-8jr8-84rv'

The NLTK library's SteppingRecursiveDescentParser.parse() method performs an unbounded top-down search on ambiguous or self-embedding grammars without enforcing any time or step limits. This allows an attacker who can influence the grammar and input tokens to cause the parser to consume CPU indefinitely, resulting in a denial of service. The base RecursiveDescentParser enforces a max_time limit, but the stepping subclass overrides this behavior and lacks any timeout mechanism. This vulnerability affects NLTK versions prior to 3.10.4.