Threats tagged 'ghsa-v8f3-6phw-6mh9'

NLTK's ConllCorpusReader.srl_instances() method has a quadratic-time CPU denial of service vulnerability when processing semantic-role-labeling (SRL) data from a CoNLL corpus. An attacker can craft a corpus with many predicates and span columns, placing the sole head span in the last column, causing the instance builder to perform excessive nested rescans. This leads to sustained single-threaded CPU exhaustion, resulting in availability loss. The vulnerability affects NLTK versions prior to 3.10.4 and is fixed in version 3.10.4. Exploitation requires the application to process untrusted CoNLL SRL data using the vulnerable API. Confidentiality and integrity are not impacted.