Most recent entries from all

BREW-acronym-CVE-2026-81723 — NLTK: Quadratic CPU Exhaustion in `XMLCorpusView._read_xml_fragment()`

Affected: Homebrew: acronym

## Summary

`XMLCorpusView._read_xml_fragment()` reads a corpus file in 1 KiB blocks, appending each block to a growing `fragment` string, then calls `_VALID_XML_RE.match(fragment)` on the full accumulated buffer every iteration. Because each iteration rescans the entire accumulated fragment, the total amount of work grows quadratically with input size.

Commit `c9c332284` (CWE-1333) made each `match()` call linear. The quadratic behavior is separate: the loop calls `match()` once per 1 KiB block, each time on a longer buffer.

On the test system, an 8 MiB malformed XML file consumed approximately 48 CPU-seconds through the public `BNCCorpusReader.words()` API with no source modification. Absolute timings vary by hardware. `_read_xml_fragment()` imposes no limit on fragment size or iteration count.

## Details

**File:** `nltk/corpus/reader/xmldocs.py` **Function:** `XMLCorpusView._read_xml_fragment()`, lines 261–308

The relevant loop:

```python fragment = "" while True: fragment += stream.read(self._BLOCK_SIZE) # grows by 1 KiB per iteration if self._VALID_XML_RE.match(fragment): # rescans full buffer each time return fragment ... last_open_bracket = fragment.rfind("<") if last_open_bracket > 0: # False for single-'<' payload if self._VALID_XML_RE.match(fragment[:last_open_bracket]): return ... # loop continues ```

For a payload of `b'<' + b'a' * (N-1)`:

- For this malformed input, `…

fkie_cve-2026-81723

NLTK versions before 3.10.3 contain a quadratic CPU exhaustion vulnerability in XMLCorpusView._read_xml_fragment() that rescans accumulated XML fragments on every 1 KiB block read. Attackers can provide malformed XML corpus files to cause severe CPU consumption and denial of service through affected readers like BNCCorpusReader.

Withdrawn: GHSA-hqv3-xm29-p9hq — Duplicate Advisory: Quadratic CPU Exhaustion in `XMLCorpusView._read_xml_fragment()`

Withdrawn by the publisher.

Affected: PyPI: nltk

## Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-vp2x-qp44-57v7. This link is maintained to preserve external references.

## Original Description NLTK versions before 3.10.3 contain a quadratic CPU exhaustion vulnerability in XMLCorpusView._read_xml_fragment() that rescans accumulated XML fragments on every 1 KiB block read. Attackers can provide malformed XML corpus files to cause severe CPU consumption and denial of service through affected readers like BNCCorpusReader.

PYSEC-2026-3871 — NLTK: Quadratic CPU Exhaustion in `XMLCorpusView._read_xml_fragment()`