CVE-2026-66393
HIGHDescription
NLTK versions before 3.9.4 contain an unbounded recursion vulnerability in JSONTaggedDecoder.decode_obj() that allows attackers to cause denial of service by supplying deeply nested JSON structures. Attackers can craft JSON payloads exceeding the recursion limit to trigger an unhandled RecursionError that crashes the Python process.
Is your site exposed to CVE-2026-66393?
Run a free security scan — no signup, results in seconds.
CVSS v3.1 Score
EPSS — Exploit Prediction
EPSS estimates the probability that this vulnerability will be exploited in the wild within the next 30 days. A higher score means more likely to be exploited.
Weakness Type (CWE)
Affected Products
| Vendor | Product |
|---|---|
| nltk | nltk |
References
Advisories & Patches
Exploits
Frequently Asked Questions
What is CVE-2026-66393? +
How severe is CVE-2026-66393? +
What products are affected by CVE-2026-66393? +
How do I check if I'm vulnerable to CVE-2026-66393? +
Related Vulnerabilities
Fixed a VM panic caused by unbounded recursion in the grpcfuse kernel module when a container created deeply nested directories …
When the module renders a Svg file that contains a <pattern> element, it might end up rendering it recursively leading …
In Xpdf 4.05 (and earlier), a PDF object loop in a CMap, via the "UseCMap" entry, leads to infinite recursion …
Kanidm is an identity management platform. Prior to version 1.9.3, a single unauthenticated GET to any /scim/v1/... endpoint with a …
eml_parser serves as a python module for parsing eml files and returning various information found in the e-mail as well …
google-protobuf contains an unbounded recursion when parsing unknown protobuf group fields. An attacker can send a small crafted payload of …