TI-2021-19660 Aliases CVE-2021-43854 GHSA-f8m6-h2c7-8h9x

Inefficient Regular Expression Complexity in nltk

LOW 38CWE-400Published 2021-12-23 · Updated 2024-08-04

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Denial of service
Confidentiality · integrity · availability: None · None · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-400.

Summary

NLTK (Natural Language Toolkit) is a suite of open source Python modules, data sets, and tutorials supporting research and development in Natural Language Processing. Versions prior to 3.6.5 are vulnerable to regular expression denial of service (ReDoS) attacks. The vulnerability is present in PunktSentenceTokenizer, sent_tokenize and word_tokenize. Any users of this class, or these two functions, are vulnerable to the ReDoS attack. In short, a specifically crafted long input to any of these vulnerable functions will cause them to take a significant amount of execution time. If your program relies on any of the vulnerable functions for tokenizing unpredictable user input, then we would strongly recommend upgrading to a version of NLTK without the vulnerability. For users unable to upgrade the execution time can be bounded by limiting the maximum length of an input to any of the vulnerable functions. Our recommendation is to implement such a limit.

Why it matters now

EPSS 0.0279 86th percentileScored 2026-11-07

Public exploit Yes 3 exploit referencesTagged by NVD

Fix Fixed nltk (nltk): 3.6.5nltk (PyPI): 3.6.6

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
nltk	nltk	before 3.6.5	3.6.5	Patch available	CNA
—	nltk (PyPI)	before 3.6.6	3.6.6	Patch available	GHSA-f8m6-h2c7-8h9x

nltk Vendornltk Affected before 3.6.5 Fixed in 3.6.5 Patch available CNA
nltk (PyPI) Vendor— Affected before 3.6.6 Fixed in 3.6.6 Patch available GHSA-f8m6-h2c7-8h9x

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:nltk:nltk::::::::	before 3.6.5	Vulnerable	nltk

cpe:2.3:a:nltk:nltk:*:*:*:*:*:*:*:* Versions before 3.6.5 Vulnerable ·nltk

Remediation

Fix · CNA nltk (nltk) Fixed in 3.6.5
Fix · GHSA-f8m6-h2c7-8h9x nltk (PyPI) Fixed in 3.6.6 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2021-43854
2026-10-03 Alias added: GHSA-f8m6-h2c7-8h9x

References

Exploit 3

Patch 1

https://github.com/nltk/nltk/commit/1405aad979c6b8080dbbc8e0858f89b2e3690341

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2021-43854

Other 2

TI-2026-00629 Arbitrary Code Execution in NLTK StanfordSegmenter via Untrusted JAR Loading CVSS 3.0CRITICAL 10.0
TI-2025-12800 Zip Slip Vulnerability in nltk/nltk Leading to Remote Code Execution CVSS 3.0CRITICAL 10.0
TI-2026-55173 NLTK before 3.10.3 JVM Argument Injection via Per-Call Options CVSS 4.0CRITICAL 9.3
TI-2026-55155 NLTK before 3.10.3 Remote Code Execution via Unsafe Pickle Deserialization CVSS 4.0CRITICAL 9.3
TI-2026-56370 nltk PorterStemmer before 3.10.3 Quadratic-time DoS CVSS 4.0HIGH 8.7
TI-2026-55172 NLTK 3.10.2 Path Traversal via corpus-reader constructors CVSS 4.0HIGH 8.8

See all 41 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences