Vulnerability PYSEC-2026-3729
Medium Risk
MEDIUM RISK
CVSS Score: 6.5
Score Range: 4.0–6.9
Medium severity vulnerabilities (CVSS 4.0–6.9). Important issues that meaningfully reduce security confidence.
1 month ago
August 22, 2026 at 03:16 PM UTC
No summary available
0.8 - 0.9.9 and 2.0b4 - 3.9.2
0.8 - 0.9.9 and 2.0b4 - 3.9.2
Details
NLTK before 3.9.3 fails to verify file integrity after downloading packages and before extraction in the downloader module. Attackers can perform man-in-the-middle attacks or DNS poisoning to inject malicious package contents that are extracted without validation.
Related Vulnerabilities
Other vulnerabilities affecting the same packages
High Risk
1 month ago
NLTK: Uncontrolled search path when invoking the Graphviz 'dot' binary
0.8 - 0.9.9 and 2.0b4 - 3.10.2 PYSEC-2026-3868
0.8 - 0.9.9 and 2.0b4 - 3.10.2 PYSEC-2026-3868
Unknown
1 month ago
NLTK: Uncontrolled resource consumption in RecursiveDescentParser via ambiguous or left-recursive grammars
0.8 - 0.9.9 and 2.0b4 - 3.10.2 PYSEC-2026-3869
0.8 - 0.9.9 and 2.0b4 - 3.10.2 PYSEC-2026-3869
Low Risk
1 month ago
NLTK: Quadratic CPU Exhaustion in `XMLCorpusView._read_xml_fragment()`
0.8 - 0.9.9 and 2.0b4 - 3.10.2 PYSEC-2026-3871
0.8 - 0.9.9 and 2.0b4 - 3.10.2 PYSEC-2026-3871
High Risk
1 month ago
NLTK AllowlistUnpickler dotted-name validation bypass allows remote code execution
3.10.0 - 3.10.2 PYSEC-2026-3867
3.10.0 - 3.10.2 PYSEC-2026-3867
High Risk
1 month ago
NLTK TweetTokenizer vulnerable to denial of service through catastrophic regex backtracking
0.8 - 0.9.9 and 2.0b4 - 3.10.0 PYSEC-2026-3870
0.8 - 0.9.9 and 2.0b4 - 3.10.0 PYSEC-2026-3870
Impacted packages
Timeline
Published
1 month ago
August 22, 2026 at 03:16 PM UTC
Fixed (3.9.3)
7 months ago
February 24, 2026 at 12:05 PM UTC
Last Modified
11 hours ago
October 16, 2026 at 10:56 AM UTC