CVE-2026-81724

NLTK (the Natural Language Toolkit for Python) before version 3.10.3 contains an uncontrolled recursion flaw (CWE-674) in nltk.featstruct.FeatStructReader, the component that parses feature structures and feature grammars. An attacker who can get crafted input to this parser submits trivial payloads made of deeply nested brackets that push past Python's recursion limit, raising an unhandled RecursionError. The result is denial of service: the process parsing the input crashes, with no confidentiality or integrity impact and no authentication required (CVSS 4.0 6.9, network vector). Any deployment running a vulnerable NLTK version whose code parses user-supplied feature structures or feature grammars is affected; the library is broadly installed across Python NLP environments, though this specific parsing path is a less commonly used feature. No in-the-wild exploitation is known (not in CISA KEV, EPSS roughly 0.3%), but a public advisory with a proof-of-concept crash exists (GHSA-cw6x-m8jw-qmrh), so the status is public PoC only.

What to do: Upgrade to NLTK 3.10.3 or later. As an interim mitigation, identify any services that pass untrusted input to nltk.featstruct.FeatStructReader or feature-grammar parsing, and depth-limit or reject deeply nested bracket input (or wrap the parse call to catch RecursionError) until patched.