PT-2026-82079 · Pypi · Nltk
CVSS v4.0
8.7
High
| Vector | AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Name of the Vulnerable Software and Affected Versions
NLTK versions prior to 3.10.0
Description
An issue exists where the
findall() functions within the Text and TokenSearcher classes accept user-supplied regular expressions without validation or timeout. This can lead to catastrophic backtracking—a condition where the regex engine takes an exponential amount of time to process a string—resulting in indefinite CPU saturation and denial of service for all users of the Python process.Recommendations
Update NLTK to version 3.10.0 or later.
As a temporary mitigation, restrict the use of the
findall() function in Text and TokenSearcher when processing untrusted user input.Exploit
Fix
DoS
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Nltk