Threats tagged 'ghsa-r53h-rw34-8h97'

NLTK versions up to 3.10.3 contain a quadratic-time CPU denial of service vulnerability in the Tree.chomsky_normal_form method when using the default right-factor binarization. This occurs because the method repeatedly removes the first element of a list using list.pop(0), which is an O(N) operation, causing the overall process to scale quadratically with the number of children in a node. An attacker supplying a wide flat tree can cause significant CPU consumption, leading to denial of service without requiring authentication or user interaction. The issue is fixed in version 3.10.4.