Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| nltk | pip | <= 3.9.3 |
Miggo AIRoot Cause AnalysisThe vulnerability, GHSA-cv2g-m8rr-888c (a duplicate of GHSA-rf74-v2fm-23pw), describes an unbounded recursion issue in the JSONTaggedDecoder.decode_obj() method of the NLTK library, affecting versions prior to 3.9.4. This method is responsible for decoding JSON objects and lists. The core problem is that the function recursively calls itself to process nested JSON structures (dictionaries and lists) without any depth limit. When an attacker provides a deeply nested JSON payload, the recursive calls exceed Python's default recursion limit (typically 1000), leading to an unhandled RecursionError. This error crashes the Python process, resulting in a Denial of Service (DoS). The fix, as described in the advisory, involves adding a _depth parameter to decode_obj() and implementing a check to raise a ValueError if the recursion depth exceeds a predefined limit (e.g., 100). This prevents the unbounded recursion and mitigates the DoS vulnerability. Therefore, JSONTaggedDecoder.decode_obj is the direct function that processes the malicious input and triggers the vulnerability, making it the key function that would appear in a runtime profiler during an exploitation attempt.
JSONTaggedDecoder.decode_objnltk/jsontags.py