CVE-2026-66393 HIGH

CVE-2026-66393: NLTK before 3.9.4 Denial of Service via JSONTaggedDecoder

Vendor Nltk
Product nltk
Weakness CWE-674
Published August 22, 2026
Last update August 26, 2026
View on NVD All CVEs

CVSS base score

8.7/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

What the vulnerability does

01Description

NLTK versions before 3.9.4 contain an unbounded recursion vulnerability in JSONTaggedDecoder.decode_obj() that allows attackers to cause denial of service by supplying deeply nested JSON structures. Attackers can craft JSON payloads exceeding the recursion limit to trigger an unhandled RecursionError that crashes the Python process.

Key dates

02Disclosure timeline

August 22, 2026 CVE published
August 26, 2026 Record updated