NLTK: Quadratic-time CPU denial of service in CCG lexicon parser (fromstring) on wide bracket bodies and operator chains
PyPI nltk · Upgrade to 3.10.4 or later · < 3.10.4 · CVE-2026-126299 · GHSA-89p3-fcch-88ph · amended
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
PyPI nltk · Upgrade to 3.10.4 or later · < 3.10.4 · CVE-2026-126299 · GHSA-89p3-fcch-88ph · amended
PyPI nltk · Upgrade to 3.10.4 or later · < 3.10.4 · CVE-2026-126298 · GHSA-r53h-rw34-8h97 · amended
PyPI nltk · Upgrade to 3.10.4 or later · < 3.10.4 · CVE-2026-126297 · GHSA-v8f3-6phw-6mh9 · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
Security reports that are not matched to your stack.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.