CVE-2026-66393 Overview
CVE-2026-66393 is an unbounded recursion vulnerability in the Natural Language Toolkit (NLTK) Python library. The flaw resides in JSONTaggedDecoder.decode_obj() and affects all NLTK versions before 3.9.4. Attackers can submit deeply nested JSON structures that exceed the Python recursion limit. This triggers an unhandled RecursionError, terminating the Python process and producing a denial-of-service condition. The vulnerability is network-exploitable when applications accept untrusted JSON input into NLTK's tagged JSON decoder.
Critical Impact
Remote attackers can crash Python processes that parse untrusted input through NLTK's JSON tagged decoder, disrupting availability of applications, pipelines, and services that depend on NLTK.
Affected Products
- NLTK versions prior to 3.9.4
- Python applications integrating nltk.jsontags.JSONTaggedDecoder
- Downstream services and NLP pipelines processing untrusted JSON with NLTK
Discovery Timeline
- 2026-08-22 - CVE-2026-66393 published to NVD
- 2026-08-27 - Last updated in NVD database
Technical Details for CVE-2026-66393
Vulnerability Analysis
The vulnerability is classified as [CWE-674] Uncontrolled Recursion. NLTK's JSONTaggedDecoder.decode_obj() recursively walks JSON structures to reconstruct tagged Python objects. The decoder does not enforce a maximum nesting depth. When the input nesting depth exceeds Python's recursion limit (default 1000), the interpreter raises a RecursionError that the library does not catch. The unhandled exception propagates up the call stack and terminates the process.
Exploitation requires no authentication and no user interaction. Any endpoint that forwards attacker-controlled JSON to NLTK's tagged decoder is exposed. The impact is limited to availability; the flaw does not corrupt memory or leak data. Services running NLTK behind web APIs, message queues, or batch processing pipelines can be repeatedly crashed with small, malformed payloads.
Root Cause
The root cause is missing recursion-depth validation in JSONTaggedDecoder.decode_obj(). The recursive traversal descends into every nested value without tracking depth or bounding call stack usage. Python's default recursion limit is easily reached with a compact JSON payload, so no large input size is required to trigger the crash.
Attack Vector
An attacker crafts a JSON document containing deeply nested arrays or objects and delivers it to any application interface that deserializes input using NLTK's tagged decoder. When decode_obj() recurses beyond the interpreter limit, Python raises RecursionError. Because NLTK does not wrap the call in exception handling, the error surfaces to the host process and causes it to exit. Refer to the NLTK GitHub Security Advisory GHSA-rf74-v2fm-23pw and the VulnCheck advisory for technical details.
Detection Methods for CVE-2026-66393
Indicators of Compromise
- Python process termination logs referencing RecursionError: maximum recursion depth exceeded
- Stack traces originating from nltk/jsontags.py and JSONTaggedDecoder.decode_obj
- Repeated crashes or worker restarts in services that accept JSON input and load NLTK
- Inbound JSON payloads with unusually deep nesting relative to normal application traffic
Detection Strategies
- Inventory Python environments and identify installations of nltk below version 3.9.4 using software composition analysis tools.
- Add web application firewall or API gateway rules to flag JSON bodies exceeding a defined nesting depth threshold.
- Instrument application logs to capture RecursionError exceptions with the originating module and endpoint.
Monitoring Recommendations
- Alert on abnormal restart rates for Python workers running NLTK-dependent services.
- Monitor API endpoints that accept JSON for spikes in 5xx responses correlated with small payload sizes and high nesting.
- Track NLTK package versions across build and runtime images to catch drift back to vulnerable releases.
How to Mitigate CVE-2026-66393
Immediate Actions Required
- Upgrade NLTK to version 3.9.4 or later in all Python environments and container images.
- Audit application code paths that pass untrusted input to JSONTaggedDecoder and restrict them to trusted sources where possible.
- Enforce request-body size and JSON nesting-depth limits at ingress proxies, API gateways, or web application firewalls.
Patch Information
The NLTK maintainers addressed the issue in nltk 3.9.4. Details are published in the NLTK GitHub Security Advisory GHSA-rf74-v2fm-23pw. Update package pins in requirements.txt, pyproject.toml, Pipfile, or equivalent manifests, then rebuild and redeploy affected services.
Workarounds
- Validate incoming JSON with a schema library that enforces maximum depth before invoking NLTK decoders.
- Wrap calls to JSONTaggedDecoder.decode_obj() in exception handlers that catch RecursionError and return a controlled error response.
- Isolate NLTK JSON parsing in a subprocess or worker pool so that a crash does not terminate the primary service.
- Reject external JSON payloads exceeding a conservative nesting depth (for example, 64 levels) at the network edge.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
