CVE-2026-66393

High

Description

NLTK versions before 3.9.4 contain an unbounded recursion vulnerability in JSONTaggedDecoder.decode_obj() that allows attackers to cause denial of service by supplying deeply nested JSON structures. Attackers can craft JSON payloads exceeding the recursion limit to trigger an unhandled RecursionError that crashes the Python process.

SeverityHigh

CVSS7.5

Exploit probability—

ProductNltk

PublishedAug 22, 2026

First seenAug 22, 2026

Weakness typeCWE-674CWE-674

How to fix

Update

nltk nltk3.9.4 or later
nltk3.9.4 or later

Vendor advisories

github.com/nltk/nltk/security/advisories/GHSA-rf74-v2fm-23pw

Affected products

Product	Affected versions	Fixed in
nltk nltk	v < 3.9.4	3.9.4
nltkPyPI	v < 3.9.4	3.9.4

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.