Technology · NLTK Project
NLTK Project Natural Language Toolkit vulnerabilities
Updated . Rebuilt every hour.
Junglewise Threat Intelligence has tracked 56 vulnerabilities in NLTK Project Natural Language Toolkit: 0 in the last 7 days and 44 in the last 90 days, 6 of them critical and 0 exploited in the wild. The most recent, CVE-2026-109956, was published on 13 October 2026. 1 vulnerability in the last four weeks, up from none in the four before.
- Last 7 days
- 0
- Last 90 days
- 44
- Critical, all time
- 6
- Exploited in the wild
- 0
About NLTK Project Natural Language Toolkit
A suite of libraries and programs for symbolic and statistical natural language processing for the Python programming language.
Latest NLTK Project Natural Language Toolkit vulnerabilities
- CVE-2026-109956: NLTK WekaClassifier path traversal in model validationhighCVSS 7EPSS 0.3%
- CVE-2026-12876: NLTK RecursiveDescentParser uncontrolled recursion denial of servicemediumCVSS 4
- NLTK tgrep regular expression denial of servicemediumCVSS 5.9
- NLTK path traversal in model-artifact APIs via pathsec bypasshighCVSS 7
- NLTK uncontrolled recursion in FeatStructReader denial of servicemediumCVSS 5.3
- NLTK Downloader hardlink filesystem containment bypasshighCVSS 7.1
- NLTK quadratic CPU exhaustion in XMLCorpusView._read_xml_fragment()lowCVSS 3.7
- CVE-2026-81727: NLTK Downloader hardlink traversal in file extractionhighCVSS 7.1EPSS 0.2%
- CVE-2026-81726: NLTK model-artifact APIs sandbox bypass via path traversalhighCVSS 7EPSS 0.3%
- CVE-2026-81724: NLTK FeatStructReader uncontrolled recursion denial of servicemediumCVSS 5.3EPSS 0.5%
- CVE-2026-81723: NLTK XMLCorpusView quadratic CPU exhaustionlowCVSS 3.7EPSS 0.3%
- CVE-2026-81722: NLTK PorterStemmer quadratic-time DoS via long runs of 'y'highCVSS 7.5EPSS 0.5%
- NLTK ReDoS in Text.findall() via unvalidated regexhighCVSS 7.5
- CVE-2026-80205: NLTK ReDoS in Text.findall via unvalidated regexhighCVSS 7.5EPSS 0.7%
- NLTK corpus readers symlink path traversal bypassmediumCVSS 5.9
- NLTK JVM argument injection in Stanford wrappers via per-call optionscriticalCVSS 9.8
- CVE-2026-79676: NLTK corpus readers symlink boundary bypasshighCVSS 5.9EPSS 0.4%
- CVE-2026-79675: NLTK JVM argument injection bypass in Stanford wrapperscriticalCVSS 9.8EPSS 0.8%
- CVE-2026-79674: NLTK corpus reader sandbox bypasshighCVSS 8.2EPSS 0.4%
- NLTK unsafe pickle deserialization in allowlisted loaderscriticalCVSS 9.8
- NLTK pathsec SSRF protection bypass with proxy configuredhighCVSS 7.5
- NLTK unsafe pickle deserialization in TransitionParsercriticalCVSS 9.6
- NLTK entity-expansion denial of service via ElementTree XML parsinghighCVSS 7.5
- CVE-2026-78683: NLTK unsafe pickle deserialization in TransitionParsercriticalCVSS 9.6EPSS 0.5%
- CVE-2026-78682: NLTK pathsec SSRF bypass with HTTP proxyhighCVSS 7.5EPSS 0.4%
Most severe NLTK Project Natural Language Toolkit vulnerabilities
Exploited in the wild first, then by severity and CVSS score.
- CVE-2025-14009: NLTK Zip Slip remote code execution in downloader componentcriticalCVSS 10EPSS 0.9%
- CVE-2026-79675: NLTK JVM argument injection bypass in Stanford wrapperscriticalCVSS 9.8EPSS 0.8%
- NLTK JVM argument injection in Stanford wrappers via per-call optionscriticalCVSS 9.8
- NLTK unsafe pickle deserialization in allowlisted loaderscriticalCVSS 9.8
- CVE-2026-78683: NLTK unsafe pickle deserialization in TransitionParsercriticalCVSS 9.6EPSS 0.5%
- NLTK unsafe pickle deserialization in TransitionParsercriticalCVSS 9.6
- CVE-2026-71513: NLTK AllowlistUnpickler dotted-name validation bypasshighCVSS 8.8EPSS 1.1%
- CVE-2026-0847: NLTK path traversal in CorpusReader classeshighCVSS 8.6EPSS 0.9%
- CVE-2026-0846: NLTK arbitrary file read in nltk.util.filestringhighCVSS 8.6EPSS 0.5%
- CVE-2026-12075: NLTK DNS-rebinding SSRF filter bypass in pathsec.urlopenhighCVSS 8.6
Vulnerabilities per week
1 vulnerability in the last four weeks, up from none in the four before. The last 13 weeks, by the week each vulnerability was published.
| Week of | Bar | Vulns | Critical |
|---|---|---|---|
| 17 Aug 2026 | 18 | 0 | |
| 24 Aug 2026 | 23 | 5 | |
| 31 Aug 2026 | 2 | 0 | |
| 7 Sep 2026 | 0 | 0 | |
| 14 Sep 2026 | 0 | 0 | |
| 21 Sep 2026 | 0 | 0 | |
| 28 Sep 2026 | 0 | 0 | |
| 5 Oct 2026 | 0 | 0 | |
| 12 Oct 2026 | 1 | 0 | |
| 19 Oct 2026 | 0 | 0 | |
| 26 Oct 2026 | 0 | 0 | |
| 2 Nov 2026 | 0 | 0 | |
| 9 Nov 2026 | 0 | 0 |
Embed a badge
A live badge for a README, a status page or an internal wiki: how many NLTK Project Natural Language Toolkit vulnerabilities were published in the last 7 days and how many of them are critical, refreshed hourly.
[](https://junglewise.ai/threats/technologies/natural-language-toolkit)<a href="https://junglewise.ai/threats/technologies/natural-language-toolkit"><img src="https://junglewise.ai/threats/technologies/natural-language-toolkit/badge.svg" alt="NLTK Project Natural Language Toolkit vulnerabilities" /></a>How this is built
Junglewise Threat Intelligence collects vulnerabilities from NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories, and matches each one to the technologies and vendors it affects. Dates are the date a vulnerability was published, in UTC.
The pages are rebuilt from the database every hour. Frozen weekly and monthly reports never change once published, so they can be cited.
Use this data
The same data is at https://junglewise.ai/threats/technologies/natural-language-toolkit.json, and this page as text at https://junglewise.ai/threats/technologies/natural-language-toolkit.md, for scripts and language models. It is free to reuse under CC BY 4.0 with a link back to this page.
Cite as: Junglewise Threat Intelligence, "NLTK Project Natural Language Toolkit vulnerabilities", https://junglewise.ai/threats/technologies/natural-language-toolkit, 13 November 2026.