Unbounded Recursion in NLTK's JSONTaggedDecoder Leading to Denial of Service
Summary
GHSA-rf74-v2fm-23pw: Natural Language Toolkit (NLTK) has unbounded recursion in JSONTaggedDecoder.decode_obj() may cause DoS. Affects nltk versions < 3.9.3. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Natural Language Toolkit (NLTK) is a powerful library in Python used for working with human language data (text). It provides easy-to-use interfaces to over 50 corpora and lexical resources, along with a suite of text processing libraries for classification, tokenization, stemming, tagging, parsing, and more. However, a vulnerability exists in its JSON handling functionality, specifically in the JSONTaggedDecoder class, which can lead to denial of service due to unbounded recursion.
Vulnerability Detail
The vulnerability arises from the method JSONTaggedDecoder.decode_obj() in nltk/jsontags.py, which recursively calls itself without a depth limit. When processing a deeply nested JSON structure that exceeds the default recursion limit (sys.getrecursionlimit()), it raises an unhandled RecursionError, causing the Python process to crash. This can be exploited by passing specially crafted JSON data to the decoder, leading to potential denial of service in applications that utilize this functionality.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, avoid passing deeply nested JSON structures to the JSONTaggedDecoder. If you must process such data, consider flattening the JSON structure before decoding it.
Conclusion
In summary, the unbounded recursion vulnerability in NLTK's JSONTaggedDecoder can lead to denial of service when processing deeply nested JSON structures. It is crucial to update the package and implement the suggested code changes to mitigate this risk.
See every vulnerability recorded for nltk →
FAQ
The CVSS score of this vulnerability is 5.1, indicating a moderate severity level.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The vulnerability affects NLTK versions up to and including 3.9.3.
If left unaddressed, this vulnerability can lead to denial of service, crashing your application when processing deeply nested JSON data.
Yes, updating to the latest version of NLTK will address this vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for nltk.
