NLTK Unbounded Recursion in JSON Decoder Causes DoS

NLTK (Natural Language Toolkit) versions before 3.9.4 contain an unbounded recursion vulnerability in the JSONTaggedDecoder.decode_obj() function that enables denial of service attacks. By supplying deeply nested JSON structures, attackers can exceed Python's recursion limit and trigger an unhandled RecursionError that crashes the entire Python process. This vulnerability affects any application using vulnerable NLTK versions to parse untrusted JSON data, particularly NLP pipelines, chatbots, and data processing systems that handle user-supplied input. The high CVSS score of 7.5 reflects the ease of exploitation and significant availability impact—a single malicious JSON payload can render dependent services completely unavailable.

While this CVE currently maps to zero Casky skills and no MITRE ATT&CK techniques, practitioners using Casky.ai's Claude-powered analysis would detect attack patterns through resource exhaustion and process termination monitoring. Security teams should look for suspicious JSON parsing failures, unexpected Python process crashes, and abnormal memory/CPU spikes preceding service outages. Extended reasoning capabilities help practitioners correlate these indicators with input validation gaps and identify applications parsing untrusted JSON sources. The key detection pattern involves monitoring for RecursionError exceptions from NLTK components and validating JSON input depth limits—defensive measures that fall under input validation and resource constraint hardening rather than traditional attack techniques.