Vulnerabilities CVE-2026-66393

CVE-2026-66393

High

Open

TLP:CLEAR

NLTK before 3.9.4 Denial of Service via JSONTaggedDecoder

NVD CVE.org

AI Analysis

No AI analysis yet.

Description

NLTK versions before 3.9.4 contain an unbounded recursion vulnerability in JSONTaggedDecoder.decode_obj() that allows attackers to cause denial of service by supplying deeply nested JSON structures. Attackers can craft JSON payloads exceeding the recursion limit to trigger an unhandled RecursionError that crashes the Python process.

Details

CVSS Score: 8.7
CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Confidence: 90%
Published: Aug 22, 2026
Last Modified: Aug 22, 2026

Notes

No notes yet. Click "Add Note" to create the first analysis note.

Opinions

No opinions yet. Be the first to assess this intelligence.