https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 15 Nov 2026 07:08:12 +0000 https://db.gcve.eu/vuln/brew-acronym-cve-2026-126298 <p><strong>Affected:</strong> Homebrew: acronym</p> <p>## Summary</p> <p>`Tree.chomsky_normal_form()` binarizes a parse tree and defaults to right factoring. For a node with N children the right-factor branch repeatedly removes the first element of a working list with `list.pop(0)`, which shifts all remaining elements each time, so binarizing one wide node costs O(N^2). An application that converts an attacker-supplied treebank tree to Chomsky Normal Form can be forced into tens of seconds of single-threaded CPU by one wide flat tree. No authentication or user interaction is required.</p> <p>## Root Cause</p> <p>In the default right-factor branch the transform executes `curNode[0:] = [nodeCopy.pop(0), newNode]` inside a loop over the N children of a node. `list.pop(0)` is O(len) because it shifts every remaining element down by one; performed N-2 times over a shrinking length-N list this sums to O(N^2). The left-factor branch instead uses `nodeCopy.pop()` (removing the last element), which is O(1) and linear overall, so the two branches differ only by this front-versus-back removal. No cap is placed on the child count of a node, and the public `Tree.fromstring` parser accepts an arbitrarily wide bracketed tree.</p> <p>```text Affected function: - nltk.tree.transforms.chomsky_normal_form (nltk/tree/transforms.py; right-factor sink at line 168, O(1) left control at line 179) Public entry points: nltk.tree.Tree.chomsky_normal_form (nltk/tree/tree.py:455, default factor=&#34;right&#34;); nltk.tree.Tree.fromstring (nltk/tree/tree.py:592). ```</p> <p>## Impact</p> <p>An attacke…</p> <p><strong>Affected:</strong> Homebrew: acronym</p> <p>## Summary</p> <p>`Tree.chomsky_normal_form()` binarizes a parse tree and defaults to right factoring. For a node with N children the right-factor branch repeatedly removes the first element of a working list with `list.pop(0)`, which shifts all remaining elements each time, so binarizing one wide node costs O(N^2). An application that converts an attacker-supplied treebank tree to Chomsky Normal Form can be forced into tens of seconds of single-threaded CPU by one wide flat tree. No authentication or user interaction is required.</p> <p>## Root Cause</p> <p>In the default right-factor branch the transform executes `curNode[0:] = [nodeCopy.pop(0), newNode]` inside a loop over the N children of a node. `list.pop(0)` is O(len) because it shifts every remaining element down by one; performed N-2 times over a shrinking length-N list this sums to O(N^2). The left-factor branch instead uses `nodeCopy.pop()` (removing the last element), which is O(1) and linear overall, so the two branches differ only by this front-versus-back removal. No cap is placed on the child count of a node, and the public `Tree.fromstring` parser accepts an arbitrarily wide bracketed tree.</p> <p>```text Affected function: - nltk.tree.transforms.chomsky_normal_form (nltk/tree/transforms.py; right-factor sink at line 168, O(1) left control at line 179) Public entry points: nltk.tree.Tree.chomsky_normal_form (nltk/tree/tree.py:455, default factor=&#34;right&#34;); nltk.tree.Tree.fromstring (nltk/tree/tree.py:592). ```</p> <p>## Impact</p> <p>An attacke…</p> https://db.gcve.eu/vuln/brew-acronym-cve-2026-126298 https://db.gcve.eu/vuln/cve-2026-126298 <p><strong>Affected:</strong> nltk</p> <p>NLTK before 3.10.4 contains a denial of service vulnerability in Tree.chomsky_normal_form that allows remote attackers to exhaust CPU through quadratic-time right-factor binarization using list.pop(0). Attackers can supply a wide flat treebank tree parsed by Tree.fromstring to force tens of seconds of single-threaded CPU consumption, blocking the processing thread.</p> <p><strong>Affected:</strong> nltk</p> <p>NLTK before 3.10.4 contains a denial of service vulnerability in Tree.chomsky_normal_form that allows remote attackers to exhaust CPU through quadratic-time right-factor binarization using list.pop(0). Attackers can supply a wide flat treebank tree parsed by Tree.fromstring to force tens of seconds of single-threaded CPU consumption, blocking the processing thread.</p> https://db.gcve.eu/vuln/cve-2026-126298