Bug 35188 - python3-nltk new security issue CVE-2026-0847
Summary: python3-nltk new security issue CVE-2026-0847
Status: RESOLVED FIXED
Alias: None
Product: Mageia
Classification: Unclassified
Component: Security (show other bugs)
Version: 9
Hardware: All Linux
Priority: Normal normal
Target Milestone: ---
Assignee: QA Team
QA Contact: Sec team
URL:
Whiteboard: MGA9-64-OK
Keywords: advisory, validated_update
Depends on:
Blocks:
 
Reported: 2026-03-09 15:44 CET by Nicolas Salguero
Modified: 2026-03-14 01:35 CET (History)
4 users (show)

See Also:
Source RPM: python-nltk-3.8.1-1.mga9.src.rpm
CVE: CVE-2026-0847
Status comment:
herman.viaene: test_passed_mga9_64+

Attachments
Add an attachment (proposed patch, testcase, etc.)

Description Nicolas Salguero 2026-03-09 15:44:43 CET 
openSUSE has issued an advisory on March 8:
https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/UERV2PU6W5DFFKA4ORZASCPJ2ZDGYTBX/
Nicolas Salguero 2026-03-09 15:47:02 CET

Flags: (none) => affects_mga9+
Whiteboard: (none) => MGA9TOO
CVE: (none) => CVE-2026-0847
Status comment: (none) => Fixed upstream in 3.9.3
Source RPM: (none) => python-nltk-3.8.1-4.mga10.src.rpm, python-nltk-3.8.1-1.mga9.src.rpm

Comment 1 Lewis Smith 2026-03-10 21:53:47 CET 
Our v3.8.1 is 3y old, so an update to v3.9.3 looks overdue!

Assignee: bugsquad => python

Comment 2 papoteur 2026-03-10 22:27:15 CET 
I push the new version in cauldron and submitted it also in Mageia 9.
Waiting for the builds.

CC: (none) => yves.brungard

Comment 3 Nicolas Salguero 2026-03-11 09:25:53 CET 
Suggested advisory:
========================

The updated package fixes a security vulnerability:

Path Traversal in nltk/nltk. (CVE-2026-0847)

References:
https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/UERV2PU6W5DFFKA4ORZASCPJ2ZDGYTBX/
========================

Updated package in core/updates_testing:
========================
python3-nltk-3.9.3-1.mga9

from SRPM:
python-nltk-3.9.3-1.mga9.src.rpm

Source RPM: python-nltk-3.8.1-4.mga10.src.rpm, python-nltk-3.8.1-1.mga9.src.rpm => python-nltk-3.8.1-1.mga9.src.rpm
Status comment: Fixed upstream in 3.9.3 => (none)
Flags: affects_mga9+ => (none)
Assignee: python => qa-bugs
Status: NEW => ASSIGNED
Version: Cauldron => 9
Whiteboard: MGA9TOO => (none)

Comment 4 Herman Viaene 2026-03-11 14:43:10 CET 
MGA9-64 server Plasma Wayland on Compaq H000SB.
No installation issues.
Ref bug 30604, so OK on clean install.

Whiteboard: (none) => MGA9-64-OK
CC: (none) => herman.viaene
Flags: (none) => test_passed_mga9_64+

Comment 5 papoteur 2026-03-11 15:36:23 CET 
A session according to first page of the project:
python
Python 3.10.18 (main, Dec  8 2025, 12:59:32) [GCC 12.3.0] on linux
Type "help", "copyright", "credits" or "license" for more information.
>>> import nltk
>>> sentence = """At eight o'clock on Thursday morning
... ... Arthur didn't feel very good."""
>>> tokens = nltk.word_tokenize(sentence)
Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
  File "/usr/lib/python3.10/site-packages/nltk/tokenize/__init__.py", line 142, in word_tokenize
    sentences = [text] if preserve_line else sent_tokenize(text, language)
  File "/usr/lib/python3.10/site-packages/nltk/tokenize/__init__.py", line 119, in sent_tokenize
    tokenizer = _get_punkt_tokenizer(language)
  File "/usr/lib/python3.10/site-packages/nltk/tokenize/__init__.py", line 105, in _get_punkt_tokenizer
    return PunktTokenizer(language)
  File "/usr/lib/python3.10/site-packages/nltk/tokenize/punkt.py", line 1744, in __init__
    self.load_lang(lang)
  File "/usr/lib/python3.10/site-packages/nltk/tokenize/punkt.py", line 1749, in load_lang
    lang_dir = find(f"tokenizers/punkt_tab/{lang}/")
  File "/usr/lib/python3.10/site-packages/nltk/data.py", line 696, in find
    raise LookupError(resource_not_found)
LookupError: 
**********************************************************************
  Resource 'punkt_tab' not found.
  Please use the NLTK Downloader to obtain the resource:

  >>> import nltk
  >>> nltk.download('punkt_tab')

  For more information see: https://www.nltk.org/data.html

  Attempted to load 'tokenizers/punkt_tab/english/'

  Searched in:
    - '/home/yves/nltk_data'
    - '/usr/nltk_data'
    - '/usr/share/nltk_data'
    - '/usr/lib/nltk_data'
    - '/usr/share/nltk_data'
    - '/usr/local/share/nltk_data'
    - '/usr/lib/nltk_data'
    - '/usr/local/lib/nltk_data'
**********************************************************************

>>> sentence = """At eight o'clock on Thursday morning Arthur didn't feel very good."""
>>> tokens = nltk.word_tokenize(sentence)
Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
  File "/usr/lib/python3.10/site-packages/nltk/tokenize/__init__.py", line 142, in word_tokenize
    sentences = [text] if preserve_line else sent_tokenize(text, language)
  File "/usr/lib/python3.10/site-packages/nltk/tokenize/__init__.py", line 119, in sent_tokenize
    tokenizer = _get_punkt_tokenizer(language)
  File "/usr/lib/python3.10/site-packages/nltk/tokenize/__init__.py", line 105, in _get_punkt_tokenizer
    return PunktTokenizer(language)
  File "/usr/lib/python3.10/site-packages/nltk/tokenize/punkt.py", line 1744, in __init__
    self.load_lang(lang)
  File "/usr/lib/python3.10/site-packages/nltk/tokenize/punkt.py", line 1749, in load_lang
    lang_dir = find(f"tokenizers/punkt_tab/{lang}/")
  File "/usr/lib/python3.10/site-packages/nltk/data.py", line 696, in find
    raise LookupError(resource_not_found)
LookupError: 
**********************************************************************
  Resource 'punkt_tab' not found.
  Please use the NLTK Downloader to obtain the resource:

  >>> import nltk
  >>> nltk.download('punkt_tab')

  For more information see: https://www.nltk.org/data.html

  Attempted to load 'tokenizers/punkt_tab/english/'

  Searched in:
    - '/home/yves/nltk_data'
    - '/usr/nltk_data'
    - '/usr/share/nltk_data'
    - '/usr/lib/nltk_data'
    - '/usr/share/nltk_data'
    - '/usr/local/share/nltk_data'
    - '/usr/lib/nltk_data'
    - '/usr/local/lib/nltk_data'
**********************************************************************

>>> nltk.download('punkt_tab')
[nltk_data] Downloading package punkt_tab to /home/yves/nltk_data...
[nltk_data]   Unzipping tokenizers/punkt_tab.zip.
True
>>> tokens = nltk.word_tokenize(sentence)
>>> tokens
['At', 'eight', "o'clock", 'on', 'Thursday', 'morning', 'Arthur', 'did', "n't", 'feel', 'very', 'good', '.']
>>> tagged = nltk.pos_tag(tokens)
Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
  File "/usr/lib/python3.10/site-packages/nltk/tag/__init__.py", line 168, in pos_tag
    tagger = _get_tagger(lang)
  File "/usr/lib/python3.10/site-packages/nltk/tag/__init__.py", line 110, in _get_tagger
    tagger = PerceptronTagger()
  File "/usr/lib/python3.10/site-packages/nltk/tag/perceptron.py", line 183, in __init__
    self.load_from_json(lang, loc)
  File "/usr/lib/python3.10/site-packages/nltk/tag/perceptron.py", line 281, in load_from_json
    loc = find(f"taggers/averaged_perceptron_tagger_{lang}/")
  File "/usr/lib/python3.10/site-packages/nltk/data.py", line 696, in find
    raise LookupError(resource_not_found)
LookupError: 
**********************************************************************
  Resource 'averaged_perceptron_tagger_eng' not found.
  Please use the NLTK Downloader to obtain the resource:

  >>> import nltk
  >>> nltk.download('averaged_perceptron_tagger_eng')

  For more information see: https://www.nltk.org/data.html

  Attempted to load 'taggers/averaged_perceptron_tagger_eng/'

  Searched in:
    - '/home/yves/nltk_data'
    - '/usr/nltk_data'
    - '/usr/share/nltk_data'
    - '/usr/lib/nltk_data'
    - '/usr/share/nltk_data'
    - '/usr/local/share/nltk_data'
    - '/usr/lib/nltk_data'
    - '/usr/local/lib/nltk_data'
**********************************************************************

>>> 
KeyboardInterrupt
>>> tagged = nltk.pos_tag(tokens)
Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
  File "/usr/lib/python3.10/site-packages/nltk/tag/__init__.py", line 168, in pos_tag
    tagger = _get_tagger(lang)
  File "/usr/lib/python3.10/site-packages/nltk/tag/__init__.py", line 110, in _get_tagger
    tagger = PerceptronTagger()
  File "/usr/lib/python3.10/site-packages/nltk/tag/perceptron.py", line 183, in __init__
    self.load_from_json(lang, loc)
  File "/usr/lib/python3.10/site-packages/nltk/tag/perceptron.py", line 281, in load_from_json
    loc = find(f"taggers/averaged_perceptron_tagger_{lang}/")
  File "/usr/lib/python3.10/site-packages/nltk/data.py", line 696, in find
    raise LookupError(resource_not_found)
LookupError: 
**********************************************************************
  Resource 'averaged_perceptron_tagger_eng' not found.
  Please use the NLTK Downloader to obtain the resource:

  >>> import nltk
  >>> nltk.download('averaged_perceptron_tagger_eng')

  For more information see: https://www.nltk.org/data.html

  Attempted to load 'taggers/averaged_perceptron_tagger_eng/'

  Searched in:
    - '/home/yves/nltk_data'
    - '/usr/nltk_data'
    - '/usr/share/nltk_data'
    - '/usr/lib/nltk_data'
    - '/usr/share/nltk_data'
    - '/usr/local/share/nltk_data'
    - '/usr/lib/nltk_data'
    - '/usr/local/lib/nltk_data'
**********************************************************************

>>> nltk.download('averaged_perceptron_tagger_eng')
[nltk_data] Downloading package averaged_perceptron_tagger_eng to
[nltk_data]     /home/yves/nltk_data...
[nltk_data]   Unzipping taggers/averaged_perceptron_tagger_eng.zip.
True
>>> tagged = nltk.pos_tag(tokens)
>>> tagged[0:6]
[('At', 'IN'), ('eight', 'CD'), ("o'clock", 'NN'), ('on', 'IN'), ('Thursday', 'NNP'), ('morning', 'NN')]
>>> from nltk.corpus import treebank
>>> t = treebank.parsed_sents('wsj_0001.mrg')[0]
Traceback (most recent call last):
  File "/usr/lib/python3.10/site-packages/nltk/corpus/util.py", line 85, in __load
    root = nltk.data.find(f"{self.subdir}/{zip_name}")
  File "/usr/lib/python3.10/site-packages/nltk/data.py", line 696, in find
    raise LookupError(resource_not_found)
LookupError: 
**********************************************************************
  Resource 'treebank' not found.
  Please use the NLTK Downloader to obtain the resource:

  >>> import nltk
  >>> nltk.download('treebank')

  For more information see: https://www.nltk.org/data.html

  Attempted to load 'corpora/treebank.zip/treebank/combined/'

  Searched in:
    - '/home/yves/nltk_data'
    - '/usr/nltk_data'
    - '/usr/share/nltk_data'
    - '/usr/lib/nltk_data'
    - '/usr/share/nltk_data'
    - '/usr/local/share/nltk_data'
    - '/usr/lib/nltk_data'
    - '/usr/local/lib/nltk_data'
**********************************************************************


During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
  File "/usr/lib/python3.10/site-packages/nltk/corpus/util.py", line 129, in __getattr__
    self.__load()
  File "/usr/lib/python3.10/site-packages/nltk/corpus/util.py", line 87, in __load
    raise e
  File "/usr/lib/python3.10/site-packages/nltk/corpus/util.py", line 82, in __load
    root = nltk.data.find(f"{self.subdir}/{self.__name}")
  File "/usr/lib/python3.10/site-packages/nltk/data.py", line 696, in find
    raise LookupError(resource_not_found)
LookupError: 
**********************************************************************
  Resource 'treebank' not found.
  Please use the NLTK Downloader to obtain the resource:

  >>> import nltk
  >>> nltk.download('treebank')

  For more information see: https://www.nltk.org/data.html

  Attempted to load 'corpora/treebank/combined'

  Searched in:
    - '/home/yves/nltk_data'
    - '/usr/nltk_data'
    - '/usr/share/nltk_data'
    - '/usr/lib/nltk_data'
    - '/usr/share/nltk_data'
    - '/usr/local/share/nltk_data'
    - '/usr/lib/nltk_data'
    - '/usr/local/lib/nltk_data'
**********************************************************************

>>> nltk.download('treebank')
[nltk_data] Downloading package treebank to /home/yves/nltk_data...
[nltk_data]   Unzipping corpora/treebank.zip.
True
>>> t = treebank.parsed_sents('wsj_0001.mrg')[0]
>>> t.draw()
---------- A tree is displayed in a window ------------------

Thus, OK
katnatek 2026-03-12 21:01:12 CET

Keywords: (none) => advisory

Comment 6 Thomas Andrews 2026-03-13 22:17:19 CET 
Validating.

CC: (none) => andrewsfarm, sysadmin-bugs
Keywords: (none) => validated_update

Comment 7 Mageia Robot 2026-03-14 01:35:27 CET 
An update for this issue has been pushed to the Mageia Updates repository.

https://advisories.mageia.org/MGASA-2026-0057.html

Status: ASSIGNED => RESOLVED
Resolution: (none) => FIXED
Note You need to log in before you can comment on or make changes to this bug.