- Severity: HIGH
- CVE: CVE-2026-126303
- Ecosystems: pip
- Packages: nltk
## Summary
`nltk.parse.recursivedescent.SteppingRecursiveDescentParser.parse()` performs an unbounded top-down search over ambiguous or self-embedding context-free grammars with no wall-clock or step limit. An actor who can influence the grammar and supply a short input to a caller that uses this parser can force a single `parse()` call to pin a CPU core indefinitely, producing a denial of service. The related base class `RecursiveDescentParser` gained a `max_time` wall-clock deadline, but the stepping subclass drives its own step loop and never arms or consults that deadline, and its constructor does not accept a `max_time` parameter, so the guard cannot be enabled on this path.
## Root Cause
`RecursiveDescentParser` bounds its recursive search inside `_parse`: it arms a wall-clock deadline on the first step and raises `TimeoutError` once `max_time` (default 5.0 seconds) is exceeded. `SteppingRecursiveDescentParser` was designed for interactive single-stepping and overrides both `parse()` and `_parse`. Its `parse()` runs `initialize()` followed by a `while self.step() is not None` loop that never enters the guarded base `_parse`. Its `_parse` override is a state-capturing stub that records history and returns a sentinel, and it never references the inherited `self._parse_deadline` or `self._max_time`. Its `__init__` signature omits `max_time` entirely, so a caller cannot enable or tighten a bound. The security invariant that a single parse must terminate within a bounded…
Source: GitHub Security Advisories · 2026-11-13