Executive brief
NLTK is a widely-used natural language processing library. The library contains a regular expression denial-of-service (ReDoS) vulnerability in its comparative sentence corpus reader that allows an attacker to cause excessive CPU consumption by providing specially crafted input, potentially disrupting any application using this feature.
Technical details
NLTK versions prior to 3.6.4 contain a ReDoS vulnerability in the _read_comparison_block() function within nltk/corpus/reader/comparative_sents.py. The vulnerable regular expression is \((?!.*\()(.*)\)$, which uses nested quantifiers that cause exponential backtracking when processing input that nearly matches the pattern. An attacker who can supply input to this function can trigger catastrophic backtracking, causing the application to consume excessive CPU resources. The vulnerability is network-accessible if NLTK is exposed through a web service or API endpoint. A fix was merged in PR #2816 and released in NLTK 3.6.4.
Affected products
- NLTK NLTK before 3.6.4
Timeline
- 2021-09-29: disclosed
- 2021-09-24: patched: Patch merged in PR #2816