StackRadar

CVE-2026-12876

Medium

Advisory

Published 2 Sept 2026In the index since 6 Sept 2026
Severity
Medium
worst across findings
CVSS
6.9
base score, highest
EPSS
—
probability of exploitation
CISA KEV
Not listed
no confirmed exploitation
Charts affected
25
of 17,781 indexed, latest versions
Container images
28
deployed by those charts
Fix available
1 of 1
affected package

NLTK: Uncontrolled resource consumption in RecursiveDescentParser via ambiguous or left-recursive grammars

Carried by container images the latest versions of 25 of 17,781 indexed charts deploy, on 28 images.

Affected packageAffected versionsFixed inImages
nltkpypi3.5, 3.6.6, 3.8.1, 3.9.1+4 more3.10.328
OSV records
GHSA-ff5c-cp5c-9wjf
Also known as
PYSEC-2026-3869

Charts affected

25 by stars
ChartLatestAffected imagesRadar Score
difydify-helmVerified publisher0.38.01 of 11See more

dify dify-helm 0.38.0

1 of the 11 container images this version deploys carry CVE-2026-12876.

Container imageDigestPackageFixed in
langgenius/dify-api:1.16.1dcefa5f7c47c
nltk@3.9.4
3.10.3

Open the chart page →

22,002
oesopsmxVerified publisher4.0.321 of 25See more

oes opsmx 4.0.32

1 of the 25 container images this version deploys carry CVE-2026-12876.

Container imageDigestPackageFixed in
quay.io/opsmxpublic/ubi8-oes-datascience:isd-spin-2025.10.01-af26a30d4-202511261054d8f66f4117fe
nltk@3.9.1
3.10.3

Open the chart page →

107,811
mealieth-chartsVerified publisher0.5.11 of 1See more

mealie th-charts 0.5.1

1 of the 1 container images this version deploys carry CVE-2026-12876.

Container imageDigestPackageFixed in
ghcr.io/mealie-recipes/mealie:v3.7.0bb2939094eed
nltk@3.9.2
3.10.3

Open the chart page →

3,804
paperless-ngxalexmorbo-paperless-ngxVerified publisher0.2.01 of 2See more

paperless-ngx alexmorbo-paperless-ngx 0.2.0

1 of the 2 container images this version deploys carry CVE-2026-12876.

Container imageDigestPackageFixed in
ghcr.io/paperless-ngx/paperless-ngx:2.20.5665f2f5cc548
nltk@3.9.2
3.10.3

Open the chart page →

12,037
paperless-ngxcrystalnetVerified publisher0.2.221 of 3See more

paperless-ngx crystalnet 0.2.22

1 of the 3 container images this version deploys carry CVE-2026-12876.

Container imageDigestPackageFixed in
ghcr.io/paperless-ngx/paperless-ngx:2.13.10642357c5dbd
nltk@3.9.1
3.10.3

Open the chart page →

13,761
difykubeblocksVerified publisher0.5.11 of 5See more

dify kubeblocks 0.5.1

1 of the 5 container images this version deploys carry CVE-2026-12876.

Container imageDigestPackageFixed in
langgenius/dify-api:0.6.11fca918260dd6
nltk@3.8.1
3.10.3

Open the chart page →

20,403
reportportalreportportal-ioOfficialVerified publisher26.8.121 of 15See more

reportportal reportportal-io 26.8.12

1 of the 15 container images this version deploys carry CVE-2026-12876.

Container imageDigestPackageFixed in
reportportal/service-auto-analyzer:5.15.5c449b93629a5
nltk@3.10.0
3.10.3

Open the chart page →

11,869
mealiertomik-helm-chartsVerified publisher0.0.21 of 1See more

mealie rtomik-helm-charts 0.0.2

1 of the 1 container images this version deploys carry CVE-2026-12876.

Container imageDigestPackageFixed in
ghcr.io/mealie-recipes/mealie:v3.2.1322369a5b748
nltk@3.9.1
3.10.3

Open the chart page →

3,929
sceptresceptreai0.1.121 of 5See more

sceptre sceptreai 0.1.12

1 of the 5 container images this version deploys carry CVE-2026-12876.

Container imageDigestPackageFixed in
maponyacharles/sceptreai:api-0.1.127b37b092130a
nltk@3.10.0
3.10.3

Open the chart page →

4,369
kitchenowlchart-kitchenowl0.1.121 of 2See more

kitchenowl chart-kitchenowl 0.1.12

1 of the 2 container images this version deploys carry CVE-2026-12876.

Container imageDigestPackageFixed in
tombursch/kitchenowl-backend:v0.7.8b48e4ab727cd
nltk@3.9.4
3.10.3

Open the chart page →

4,803
csghubcsghubVerified publisher2.4.33 of 34See more

csghub csghub 2.4.3

3 of the 34 container images this version deploys carry CVE-2026-12876.

Container imageDigestPackageFixed in
opencsghq/agenticflow:ee-v0.6-52f03fead54db
nltk@3.9.1
3.10.3
opencsghq/csgbot:v0.6.7-eeaf7191a9cf8a
nltk@3.9.2
3.10.3
opencsghq/label-studio:v2.4.0b4e849fcf94a
nltk@3.9.1
3.10.3

Open the chart page →

58,897
dataflowcsghubVerified publisher2.5.01 of 7See more

dataflow csghub 2.5.0

1 of the 7 container images this version deploys carry CVE-2026-12876.

Container imageDigestPackageFixed in
opencsghq/label-studio:v2.5.047e22aa71870
nltk@3.9.1
3.10.3

Open the chart page →

6,632
jupyterhubd4nVerified publisher3.3.71 of 7See more

jupyterhub d4n 3.3.7

1 of the 7 container images this version deploys carry CVE-2026-12876.

Container imageDigestPackageFixed in
aristidetm/basic-notebook:3.6.5469dbc951224
nltk@3.8.1
3.10.3

Open the chart page →

16,604
difydify1.0.01 of 4See more

dify dify 1.0.0

1 of the 4 container images this version deploys carry CVE-2026-12876.

Container imageDigestPackageFixed in
langgenius/dify-api:1.0.0066035f93856
nltk@3.9.1
3.10.3

Open the chart page →

19,224
paperlesshomelabcihelmchartstestVerified publisher9.1.91 of 1See more

paperless homelabcihelmchartstest 9.1.9

1 of the 1 container images this version deploys carry CVE-2026-12876.

Container imageDigestPackageFixed in
ghcr.io/paperless-ngx/paperless-ngx:2.0.1ab255bea133e
nltk@3.8.1
3.10.3

Open the chart page →

16,384
label-studioinseefrlab2.3.11 of 3See more

label-studio inseefrlab 2.3.1

1 of the 3 container images this version deploys carry CVE-2026-12876.

Container imageDigestPackageFixed in
heartexlabs/label-studio:latestaa461572e8f9
nltk@3.9.3
3.10.3

Open the chart page →

3,157
paperlessk8s-home-lab-repo11.0.11 of 1See more

paperless k8s-home-lab-repo 11.0.1

1 of the 1 container images this version deploys carry CVE-2026-12876.

Container imageDigestPackageFixed in
ghcr.io/paperless-ngx/paperless-ngx:2.20.14b89f83345532
nltk@3.9.2
3.10.3

Open the chart page →

9,103
mindsdbkronkltdVerified publisher0.1.01 of 1See more

mindsdb kronkltd 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-12876.

Container imageDigestPackageFixed in
mindsdb/mindsdb:latest163011c09299
nltk@3.9.4
3.10.3

Open the chart page →

9,620
aperagkubeblocksVerified publisher0.0.0-nightly1 of 3See more

aperag kubeblocks 0.0.0-nightly

1 of the 3 container images this version deploys carry CVE-2026-12876.

Container imageDigestPackageFixed in
apecloud/aperag:v0.0.0-nightly8ac9947a2c84
nltk@3.9.1
3.10.3

Open the chart page →

8,405
paperless-ngxmt1905027.6.141 of 4See more

paperless-ngx mt190502 7.6.14

1 of the 4 container images this version deploys carry CVE-2026-12876.

Container imageDigestPackageFixed in
ghcr.io/paperless-ngx/paperless-ngx:2.20.134b05bcd28e69
nltk@3.9.2
3.10.3

Open the chart page →

11,950
smilencsaVerified publisher1.1.02 of 23See more

smile ncsa 1.1.0

2 of the 23 container images this version deploys carry CVE-2026-12876.

Container imageDigestPackageFixed in
socialmediamacroscope/preprocessing:0.1.3ca863306314b
nltk@3.8.1
3.10.3
socialmediamacroscope/topic_modeling:0.1.3fa490acac2f8
nltk@3.8.1
3.10.3

Open the chart page →

109,294
remla23-team17remla23-team171.0.01 of 2See more

remla23-team17 remla23-team17 1.0.0

1 of the 2 container images this version deploys carry CVE-2026-12876.

Container imageDigestPackageFixed in
ghcr.io/remla23-team17/model-service:1.0.0aa59fe2c4f6a
nltk@3.8.1
3.10.3

Open the chart page →

4,447
reportportalreportportal5.7.21 of 8See more

reportportal reportportal 5.7.2

1 of the 8 container images this version deploys carry CVE-2026-12876.

Container imageDigestPackageFixed in
reportportal/service-auto-analyzer:5.7.295ada4a216ce
nltk@3.6.6
3.10.3

Open the chart page →

25,737
paperless-ngxrtomik-helm-chartsVerified publisher0.0.51 of 1See more

paperless-ngx rtomik-helm-charts 0.0.5

1 of the 1 container images this version deploys carry CVE-2026-12876.

Container imageDigestPackageFixed in
ghcr.io/paperless-ngx/paperless-ngx:2.20.357ad9565bff3
nltk@3.9.2
3.10.3

Open the chart page →

10,605
classificationsignalen4.24.01 of 1See more

classification signalen 4.24.0

1 of the 1 container images this version deploys carry CVE-2026-12876.

Container imageDigestPackageFixed in
signalen/classification:ad60447d1733473e30ab0a3ba53d58141cc1d2509496ae672877
nltk@3.5
3.10.3

Open the chart page →

1,553

Container images carrying it

28 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
apecloud/aperag:v0.0.0-nightly8ac9947a2c84
nltk@3.9.1
3.10.3
1
aristidetm/basic-notebook:3.6.5469dbc951224
nltk@3.8.1
3.10.3
1
heartexlabs/label-studio:latestaa461572e8f9
nltk@3.9.3
3.10.3
1
langgenius/dify-api:1.0.0066035f93856
nltk@3.9.1
3.10.3
1
langgenius/dify-api:1.16.1dcefa5f7c47c
nltk@3.9.4
3.10.3
1
langgenius/dify-api:0.6.11fca918260dd6
nltk@3.8.1
3.10.3
1
maponyacharles/sceptreai:api-0.1.127b37b092130a
nltk@3.10.0
3.10.3
1
mindsdb/mindsdb:latest163011c09299
nltk@3.9.4
3.10.3
1
opencsghq/agenticflow:ee-v0.6-52f03fead54db
nltk@3.9.1
3.10.3
1
opencsghq/csgbot:v0.6.7-eeaf7191a9cf8a
nltk@3.9.2
3.10.3
1
opencsghq/label-studio:v2.5.047e22aa71870
nltk@3.9.1
3.10.3
1
opencsghq/label-studio:v2.4.0b4e849fcf94a
nltk@3.9.1
3.10.3
1
reportportal/service-auto-analyzer:5.7.295ada4a216ce
nltk@3.6.6
3.10.3
1
reportportal/service-auto-analyzer:5.15.5c449b93629a5
nltk@3.10.0
3.10.3
1
signalen/classification:ad60447d1733473e30ab0a3ba53d58141cc1d2509496ae672877
nltk@3.5
3.10.3
1
socialmediamacroscope/preprocessing:0.1.3ca863306314b
nltk@3.8.1
3.10.3
1
socialmediamacroscope/topic_modeling:0.1.3fa490acac2f8
nltk@3.8.1
3.10.3
1
tombursch/kitchenowl-backend:v0.7.8b48e4ab727cd
nltk@3.9.4
3.10.3
1
ghcr.io/mealie-recipes/mealie:v3.2.1322369a5b748
nltk@3.9.1
3.10.3
1
ghcr.io/mealie-recipes/mealie:v3.7.0bb2939094eed
nltk@3.9.2
3.10.3
1
ghcr.io/paperless-ngx/paperless-ngx:2.13.10642357c5dbd
nltk@3.9.1
3.10.3
1
ghcr.io/paperless-ngx/paperless-ngx:2.20.134b05bcd28e69
nltk@3.9.2
3.10.3
1
ghcr.io/paperless-ngx/paperless-ngx:2.20.357ad9565bff3
nltk@3.9.2
3.10.3
1
ghcr.io/paperless-ngx/paperless-ngx:2.20.5665f2f5cc548
nltk@3.9.2
3.10.3
1
ghcr.io/paperless-ngx/paperless-ngx:2.0.1ab255bea133e
nltk@3.8.1
3.10.3
1
ghcr.io/paperless-ngx/paperless-ngx:2.20.14b89f83345532
nltk@3.9.2
3.10.3
1
ghcr.io/remla23-team17/model-service:1.0.0aa59fe2c4f6a
nltk@3.8.1
3.10.3
1
quay.io/opsmxpublic/ubi8-oes-datascience:isd-spin-2025.10.01-af26a30d4-202511261054d8f66f4117fe
nltk@3.9.1
3.10.3
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.