https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 15 Nov 2026 07:10:09 +0000 https://db.gcve.eu/vuln/brew-acronym-cve-2026-126303 <p><strong>Affected:</strong> Homebrew: acronym</p> <p>## Summary</p> <p>`nltk.parse.recursivedescent.SteppingRecursiveDescentParser.parse()` performs an unbounded top-down search over ambiguous or self-embedding context-free grammars with no wall-clock or step limit. An actor who can influence the grammar and supply a short input to a caller that uses this parser can force a single `parse()` call to pin a CPU core indefinitely, producing a denial of service. The related base class `RecursiveDescentParser` gained a `max_time` wall-clock deadline, but the stepping subclass drives its own step loop and never arms or consults that deadline, and its constructor does not accept a `max_time` parameter, so the guard cannot be enabled on this path.</p> <p>## Root Cause</p> <p>`RecursiveDescentParser` bounds its recursive search inside `_parse`: it arms a wall-clock deadline on the first step and raises `TimeoutError` once `max_time` (default 5.0 seconds) is exceeded. `SteppingRecursiveDescentParser` was designed for interactive single-stepping and overrides both `parse()` and `_parse`. Its `parse()` runs `initialize()` followed by a `while self.step() is not None` loop that never enters the guarded base `_parse`. Its `_parse` override is a state-capturing stub that records history and returns a sentinel, and it never references the inherited `self._parse_deadline` or `self._max_time`. Its `__init__` signature omits `max_time` entirely, so a caller cannot enable or tighten a bound. The security invariant that a single parse must terminate within a bounded…</p> <p><strong>Affected:</strong> Homebrew: acronym</p> <p>## Summary</p> <p>`nltk.parse.recursivedescent.SteppingRecursiveDescentParser.parse()` performs an unbounded top-down search over ambiguous or self-embedding context-free grammars with no wall-clock or step limit. An actor who can influence the grammar and supply a short input to a caller that uses this parser can force a single `parse()` call to pin a CPU core indefinitely, producing a denial of service. The related base class `RecursiveDescentParser` gained a `max_time` wall-clock deadline, but the stepping subclass drives its own step loop and never arms or consults that deadline, and its constructor does not accept a `max_time` parameter, so the guard cannot be enabled on this path.</p> <p>## Root Cause</p> <p>`RecursiveDescentParser` bounds its recursive search inside `_parse`: it arms a wall-clock deadline on the first step and raises `TimeoutError` once `max_time` (default 5.0 seconds) is exceeded. `SteppingRecursiveDescentParser` was designed for interactive single-stepping and overrides both `parse()` and `_parse`. Its `parse()` runs `initialize()` followed by a `while self.step() is not None` loop that never enters the guarded base `_parse`. Its `_parse` override is a state-capturing stub that records history and returns a sentinel, and it never references the inherited `self._parse_deadline` or `self._max_time`. Its `__init__` signature omits `max_time` entirely, so a caller cannot enable or tighten a bound. The security invariant that a single parse must terminate within a bounded…</p> https://db.gcve.eu/vuln/brew-acronym-cve-2026-126303 https://db.gcve.eu/vuln/ghsa-4hvg-fv5c-9936 <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> PyPI: nltk</p> <p>## Duplicate Advisory</p> <p>This advisory has been withdrawn because it is a duplicate of GHSA-8fx7-8jr8-84rv. This link is maintained to preserve external references.</p> <p>## Original Description NLTK before 3.10.4 contains an uncontrolled resource consumption vulnerability in SteppingRecursiveDescentParser.parse() that lacks any max_time deadline or step limit. Attackers influencing the grammar can supply an ambiguous self-embedding grammar and short token input to force unbounded top-down search, pinning CPU cores and exhausting worker pools.</p> <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> PyPI: nltk</p> <p>## Duplicate Advisory</p> <p>This advisory has been withdrawn because it is a duplicate of GHSA-8fx7-8jr8-84rv. This link is maintained to preserve external references.</p> <p>## Original Description NLTK before 3.10.4 contains an uncontrolled resource consumption vulnerability in SteppingRecursiveDescentParser.parse() that lacks any max_time deadline or step limit. Attackers influencing the grammar can supply an ambiguous self-embedding grammar and short token input to force unbounded top-down search, pinning CPU cores and exhausting worker pools.</p> https://db.gcve.eu/vuln/ghsa-4hvg-fv5c-9936