{"metadata": {"vulnerability": "CVE-2026-126299", "count": 16, "kinds": {"milestone": 4, "sighting": 3, "kev": 0, "other": 9}, "linked_omitted": 0}, "data": [{"timestamp": "2026-10-26T00:00:00Z", "date_only": false, "value": "2026-10-26T00:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / VulnCheck", "record": "CVE-2026-126299", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-11-10T20:15:54.612Z", "date_only": false, "value": "2026-11-10T20:15:54.612Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-126299", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-11-13T09:36:26.544Z", "date_only": false, "value": "2026-11-13T09:36:26.544Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-126299", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-11-13T09:36:26.544Z", "date_only": false, "value": "2026-11-13T09:36:26.544Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / VulnCheck", "record": "CVE-2026-126299", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-11-13T10:17:34Z", "date_only": false, "value": "2026-11-13T10:17:34Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-JH6R-H4RX-2J3W", "record": "GHSA-JH6R-H4RX-2J3W", "field": "database_specific.nvd_published_at", "linked_record": true}, {"timestamp": "2026-11-13T11:24:33.737Z", "date_only": false, "value": "2026-11-13T11:24:33.737586Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117608878781330355", "record": "CVE-2026-126299", "field": "creation_timestamp", "uuid": "9c01651e-d82d-4e9e-a778-efa4dc1e5300", "content": "CVE-2026-126299 NLTK before 3.10.4 Quadratic-Time Denial of Service via CCG Lexicon fromstring NLTK before 3.10.4 contains a denial of service vulnerability in the CCG lexicon parser fromstring that allows remote attackers to exhaust CPU by supplying wide inputs. Attackers can submit lexicon text with long flat bracket bodies or operator chains, triggering quadratic string re-slicing in matchBrackets and augParseCategory that blocks worker threads.\nhttps://www.cve.org/CVERecord?id=CVE-2026-126299https://github.com/nltk/nltk/security/advisories/GHSA-89p3-fcch-88phhttps://www.vulncheck.com/advisories/nltk-before-3.10.4-quadratic-time-denial-of-service-via-ccg-lexicon-fromstring#nltk#CVE_2026_126299#bot", "url": "https://infosec.exchange/users/cve/statuses/117608878781330355"}, {"timestamp": "2026-11-13T12:31:16Z", "date_only": false, "value": "2026-11-13T12:31:16Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-JH6R-H4RX-2J3W", "record": "GHSA-JH6R-H4RX-2J3W", "field": "published", "linked_record": true}, {"timestamp": "2026-11-13T20:41:49.316Z", "date_only": false, "value": "2026-11-13T20:41:49.316593Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-126299", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-11-13T20:41:58.817Z", "date_only": false, "value": "2026-11-13T20:41:58.817Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-126299", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-11-13T20:41:58.817Z", "date_only": false, "value": "2026-11-13T20:41:58.817Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-126299", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-11-13T23:04:15Z", "date_only": false, "value": "2026-11-13T23:04:15Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-JH6R-H4RX-2J3W", "record": "GHSA-JH6R-H4RX-2J3W", "field": "modified", "linked_record": true}, {"timestamp": "2026-11-13T23:04:15Z", "date_only": false, "value": "2026-11-13T23:04:15Z", "kind": "other", "label": "Withdrawn", "source": "github \u00b7 GHSA-JH6R-H4RX-2J3W", "record": "GHSA-JH6R-H4RX-2J3W", "field": "withdrawn", "linked_record": true}, {"timestamp": "2026-11-14T00:08:50Z", "date_only": false, "value": "2026-11-14T00:08:50Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-89P3-FCCH-88PH", "record": "GHSA-89P3-FCCH-88PH", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-14T00:08:50Z", "date_only": false, "value": "2026-11-14T00:08:50.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://github.com/advisories/GHSA-89p3-fcch-88ph", "record": "CVE-2026-126299", "field": "creation_timestamp", "uuid": "767853fd-df1d-40a5-8e39-5d37a100a94a", "url": "https://github.com/advisories/GHSA-89p3-fcch-88ph", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-11-14T00:08:50Z", "date_only": false, "value": "2026-11-14T00:08:50Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-89P3-FCCH-88PH", "record": "GHSA-89P3-FCCH-88PH", "field": "modified", "linked_record": true}, {"timestamp": "2026-11-14T01:30:50Z", "date_only": false, "value": "2026-11-14T01:30:50.000000Z", "kind": "sighting", "label": "Seen", "source": "https://gist.github.com/alon710/a1a1c8fdb7b3b38a8aeab0504f70e24f", "record": "CVE-2026-126299", "field": "creation_timestamp", "uuid": "d5f68e14-1c14-49cb-bc54-f1d107dd0a39", "content": "# CVE-2026-126299: CVE-2026-126299: Quadratic Algorithmic Complexity Denial of Service in NLTK CCG Lexicon Parser\n\n> **CVSS Score:** 7.5\n> **Published:** 2026-11-14\n> **Full Report:** https://cvereports.com/reports/CVE-2026-126299\n\n## Summary\nAn algorithmic complexity vulnerability (CWE-407) in the Natural Language Toolkit (NLTK) before version 3.10.4 allows remote unauthenticated attackers to cause a denial of service via crafted Combinatory Categorial Grammar (CCG) lexicon strings. The parser in nltk.ccg.lexicon.fromstring performs repeated immutable string slicing, concatenation, and regex tail capturing, resulting in O(n^2) CPU consumption when processing wide, flat category definitions.\n\n## TL;DR\nNLTK versions prior to 3.10.4 suffer from a quadratic time complexity vulnerability in the CCG lexicon parser (`nltk.ccg.lexicon.fromstring`). Flat category definitions with long bracket bodies or operator chains bypass recursion depth checks and trigger O(n^2) string copying, exhausting single-threaded CPU resources.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CVE ID**: CVE-2026-126299 (GHSA-89p3-fcch-88ph)\n- **Vulnerability Class**: CWE-407: Inefficient Algorithmic Complexity / CWE-400: Uncontrolled Resource Consumption\n- **CVSS Score**: 7.5 High (CVSS v3.1) / 8.7 High (CVSS v4.0)\n- **Attack Vector**: Network (Unauthenticated crafted CCG lexicon input)\n- **Affected Component**: nltk.ccg.lexicon.fromstring (matchBrackets, nextCategory, augParseCategory)\n- **Exploit Status**: Public Proof-of-Concept (PoC) Available\n- **EPSS Score**: 0.58% (48.34th Percentile)\n- **Patched Version**: nltk 3.10.4\n\n## Affected Systems\n\n- Natural Language Toolkit (NLTK) Python Library (PyPI: nltk)\n- **nltk**: >= 0.8, <= 3.10.3 (Fixed in: `3.10.4`)\n\n## Mitigation\n\n- Upgrade NLTK to version 3.10.4 or later to replace quadratic string slicing with linear-time cursor indexing.\n- Enforce strict input size and line length limits on user-supplied CCG grammar specifications before passing them to nltk.ccg.lexicon.fromstring.\n- Isolate CCG lexicon parsing into dedicated worker processes with strict CPU time limits to prevent GIL starvation in web applications.\n\n**Remediation Steps:**\n1. Audit application dependencies and source code to identify usage of nltk.ccg.lexicon.fromstring or nltk.ccg.chart.fromstring.\n2. Upgrade the nltk package via pip: pip install --upgrade 'nltk>=3.10.4'.\n3. If parsing unusually large, trusted grammars that legitimately exceed 100,000 characters per category, adjust nltk.ccg.lexicon.MAX_PARSE_LEN accordingly while maintaining perimeter size controls.\n\n## References\n\n- [CVE-2026-126299 Official CVE Record](https://www.cve.org/CVERecord?id=CVE-2026-126299)\n- [NVD - CVE-2026-126299 Detail](https://nvd.nist.gov/vuln/detail/CVE-2026-126299)\n- [GitHub Security Advisory GHSA-89p3-fcch-88ph](https://github.com/nltk/nltk/security/advisories/GHSA-89p3-fcch-88ph)\n- [VulnCheck Advisory: NLTK Before 3.10.4 Quadratic-Time DoS via CCG Lexicon fromstring](https://www.vulncheck.com/advisories/nltk-before-3.10.4-quadratic-time-denial-of-service-via-ccg-lexicon-fromstring)\n- [NLTK Fix Commit 0bb5b947bd235b950cf2f90e893a498e16da0fe3](https://github.com/nltk/nltk/commit/0bb5b947bd235b950cf2f90e893a498e16da0fe3)\n- [NLTK Merge Commit cf12a5e6a439fe1d722acd53d4309911faaaaf78](https://github.com/nltk/nltk/commit/cf12a5e6a439fe1d722acd53d4309911faaaaf78)\n- [NLTK Pull Request #3944](https://github.com/nltk/nltk/pull/3944)\n- [NLTK Release v3.10.4](https://github.com/nltk/nltk/releases/tag/v3.10.4)\n- [MITRE ATT&CK Search for CVE-2026-126299](https://attack.mitre.org/search/?search=CVE-2026-126299)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-126299) - Automated Vulnerability Intelligence*", "url": "https://gist.github.com/alon710/a1a1c8fdb7b3b38a8aeab0504f70e24f"}], "metrics": {"as_of": "2026-11-14T03:21:53.541Z", "anchors": {"origin": {"timestamp": "2026-10-26T00:00:00Z", "date_only": false, "value": "2026-10-26T00:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / VulnCheck", "record": "CVE-2026-126299", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-10-26T00:00:00Z", "date_only": false, "value": "2026-10-26T00:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / VulnCheck", "record": "CVE-2026-126299", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": {"timestamp": "2026-11-14T00:08:50Z", "date_only": false, "value": "2026-11-14T00:08:50.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://github.com/advisories/GHSA-89p3-fcch-88ph", "record": "CVE-2026-126299", "field": "creation_timestamp", "uuid": "767853fd-df1d-40a5-8e39-5d37a100a94a", "url": "https://github.com/advisories/GHSA-89p3-fcch-88ph", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, "exploitation": null, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": true, "seconds": 1642130.0, "hours": 456.14722222222224, "days": 19.00613425925926, "min_seconds": 1555730.0, "max_seconds": 1642130.0, "approximate": true, "ongoing": false, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-10-26T00:00:00Z", "date_only": false, "value": "2026-10-26T00:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / VulnCheck", "record": "CVE-2026-126299", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-11-14T00:08:50Z", "date_only": false, "value": "2026-11-14T00:08:50.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://github.com/advisories/GHSA-89p3-fcch-88ph", "record": "CVE-2026-126299", "field": "creation_timestamp", "uuid": "767853fd-df1d-40a5-8e39-5d37a100a94a", "url": "https://github.com/advisories/GHSA-89p3-fcch-88ph", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 1653713.541654, "hours": 459.36487268166667, "days": 19.14020302840278, "min_seconds": 1567313.541654, "max_seconds": 1653713.541654, "approximate": true, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-10-26T00:00:00Z", "date_only": false, "value": "2026-10-26T00:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / VulnCheck", "record": "CVE-2026-126299", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-11-14T03:21:53.541Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": true, "seconds": 11583.541654, "hours": 3.2176504594444446, "days": 0.13406876914351853, "min_seconds": 11583.541654, "max_seconds": 11583.541654, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-11-14T00:08:50Z", "date_only": false, "value": "2026-11-14T00:08:50.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://github.com/advisories/GHSA-89p3-fcch-88ph", "record": "CVE-2026-126299", "field": "creation_timestamp", "uuid": "767853fd-df1d-40a5-8e39-5d37a100a94a", "url": "https://github.com/advisories/GHSA-89p3-fcch-88ph", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, "end": {"timestamp": "2026-11-14T03:21:53.541Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}}}