Ekaf

**Name of the Vulnerable Software and Affected Versions** NLTK versions prior to 3.10.0 **Description** An issue exists where the `findall()` functions within the `Text` and `TokenSearcher` classes accept user-supplied regular expressions without validation or timeout. This can lead to catastrophic backtracking—a condition where the regex engine takes an exponential amount of time to process a string—resulting in indefinite CPU saturation and denial of service for all users of the Python process. **Recommendations** Update NLTK to version 3.10.0 or later. As a temporary mitigation, restrict the use of the `findall()` function in `Text` and `TokenSearcher` when processing untrusted user input.

**Name of the Vulnerable Software and Affected Versions** NLTK versions prior to 3.10.3 **Description** The tgrep module contains a regular expression denial of service (ReDoS) issue. The ` tgrep node action()` function compiles user-supplied regular expressions within `/regex/` pattern nodes and executes them using `re.search` against tree node labels without validation or timeouts. An attacker controlling the tgrep pattern, such as through `tgrep positions()` or `tgrep compile()` exposed to external input, can provide a pattern that triggers catastrophic backtracking—a condition where the regex engine takes an exponential amount of time to process a string—leading to indefinite CPU saturation and blocking the Python process. **Recommendations** Update to version 3.10.3 or later. As a temporary mitigation, restrict external input to the `tgrep positions()` and `tgrep compile()` functions.

**Name of the Vulnerable Software and Affected Versions** NLTK versions prior to 3.10.0 **Description** An unsafe pickle deserialization issue exists in the `TransitionParser.parse()` function. The function utilizes `pickle load()` with the `restricted` parameter set to `False`, which directs deserialization through `WarningUnpickler`. Because `WarningUnpickler` does not override the `find class()` method, it allows arbitrary class resolution. This enables an attacker to execute arbitrary Python code with the privileges of the application user by providing a specially crafted model file containing pickle gadget chains (sequences of objects that trigger unintended code execution during deserialization). **Recommendations** Update NLTK to version 3.10.0 or later.