Affected: Homebrew: acronym
## Summary
`XMLCorpusView._read_xml_fragment()` reads a corpus file in 1 KiB blocks, appending each block to a growing `fragment` string, then calls `_VALID_XML_RE.match(fragment)` on the full accumulated buffer every iteration. Because each iteration rescans the entire accumulated fragment, the total amount of work grows quadratically with input size.
Commit `c9c332284` (CWE-1333) made each `match()` call linear. The quadratic behavior is separate: the loop calls `match()` once per 1 KiB block, each time on a longer buffer.
On the test system, an 8 MiB malformed XML file consumed approximately 48 CPU-seconds through the public `BNCCorpusReader.words()` API with no source modification. Absolute timings vary by hardware. `_read_xml_fragment()` imposes no limit on fragment size or iteration count.
## Details
**File:** `nltk/corpus/reader/xmldocs.py` **Function:** `XMLCorpusView._read_xml_fragment()`, lines 261–308
The relevant loop:
```python fragment = "" while True: fragment += stream.read(self._BLOCK_SIZE) # grows by 1 KiB per iteration if self._VALID_XML_RE.match(fragment): # rescans full buffer each time return fragment ... last_open_bracket = fragment.rfind("<") if last_open_bracket > 0: # False for single-'<' payload if self._VALID_XML_RE.match(fragment[:last_open_bracket]): return ... # loop continues ```
For a payload of `b'<' + b'a' * (N-1)`:
- For this malformed input, `…
NLTK versions before 3.10.3 contain a quadratic CPU exhaustion vulnerability in XMLCorpusView._read_xml_fragment() that rescans accumulated XML fragments on every 1 KiB block read. Attackers can provide malformed XML corpus files to cause severe CPU consumption and denial of service through affected readers like BNCCorpusReader.
Withdrawn by the publisher.
Affected: PyPI: nltk
## Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-vp2x-qp44-57v7. This link is maintained to preserve external references.
## Original Description NLTK versions before 3.10.3 contain a quadratic CPU exhaustion vulnerability in XMLCorpusView._read_xml_fragment() that rescans accumulated XML fragments on every 1 KiB block read. Attackers can provide malformed XML corpus files to cause severe CPU consumption and denial of service through affected readers like BNCCorpusReader.
Affected: PyPI: nltk
## Summary
`XMLCorpusView._read_xml_fragment()` reads a corpus file in 1 KiB blocks, appending each block to a growing `fragment` string, then calls `_VALID_XML_RE.match(fragment)` on the full accumulated buffer every iteration. Because each iteration rescans the entire accumulated fragment, the total amount of work grows quadratically with input size.
Commit `c9c332284` (CWE-1333) made each `match()` call linear. The quadratic behavior is separate: the loop calls `match()` once per 1 KiB block, each time on a longer buffer.
On the test system, an 8 MiB malformed XML file consumed approximately 48 CPU-seconds through the public `BNCCorpusReader.words()` API with no source modification. Absolute timings vary by hardware. `_read_xml_fragment()` imposes no limit on fragment size or iteration count.
## Details
**File:** `nltk/corpus/reader/xmldocs.py` **Function:** `XMLCorpusView._read_xml_fragment()`, lines 261–308
The relevant loop:
```python fragment = "" while True: fragment += stream.read(self._BLOCK_SIZE) # grows by 1 KiB per iteration if self._VALID_XML_RE.match(fragment): # rescans full buffer each time return fragment ... last_open_bracket = fragment.rfind("<") if last_open_bracket > 0: # False for single-'<' payload if self._VALID_XML_RE.match(fragment[:last_open_bracket]): return ... # loop continues ```
For a payload of `b'<' + b'a' * (N-1)`:
- For this malformed input, `…
Affected: Ubuntu:Pro:14.04:LTS: nltk, Ubuntu:Pro:16.04:LTS: nltk, Ubuntu:Pro:18.04:LTS: nltk, Ubuntu:Pro:20.04:LTS: nltk, Ubuntu:Pro:22.04:LTS: nltk, Ubuntu:Pro:24.04:LTS: nltk, Ubuntu:Pro:26.04:LTS: nltk
NLTK versions before 3.10.3 contain a quadratic CPU exhaustion vulnerability in XMLCorpusView._read_xml_fragment() that rescans accumulated XML fragments on every 1 KiB block read. Attackers can provide malformed XML corpus files to cause severe CPU consumption and denial of service through affected readers like BNCCorpusReader.