NLTK before 3.10.3 contains an uncontrolled recursion vulnerability in nltk.featstruct.FeatStructReader that allows unauthenticated attackers to cause a denial of service by supplying deeply nested feature-structure input. Attackers can craft trivial payloads with nested brackets that exceed Python's recursion limit and raise an unhandled RecursionError, crashing applications that parse user-supplied feature structures or feature grammars.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - NLTK before 3.10.3 contains an uncontrolled recursion vulnerability in nltk.featstruct.FeatStructReader
    that allows unauthenticated attackers to cause a denial of service by supplying deeply nested feature-
    structure input. Attackers can craft trivial payloads with nested brackets that exceed Python's recursion
    limit and raise an unhandled RecursionError, crashing applications that parse user-supplied feature
    structures or feature grammars. (CVE-2026-81724)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - NLTK before 3.10.3 contains an uncontrolled recursion vulnerability in nltk.featstruct.FeatStructReader     that allows unauthenticated attackers to cause a denial of service by supplying deeply nested feature-     structure input. Attackers can craft trivial payloads with nested brackets that exceed Python's recursion     limit and raise an unhandled RecursionError, crashing applications that parse user-supplied feature     structures or feature grammars. (CVE-2026-81724)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
459867	Echo: nltk: security update to 3.10.3	Tenable Cloud Security	Echo Local Security Checks	Local	medium
459867	Echo: nltk: security update to 3.10.3	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	medium
341150	Linux Distros Unpatched Vulnerability : CVE-2026-81724	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-81724

medium

Tenable Plugins

medium

medium

medium