# CVE-2021-3828: PYSEC-2021-356 - nltk is vulnerable to Inefficient Regular Expression Complexity

Source: https://junglewise.ai/threats/cve-2021-3828-nltk-redos-in-comparative-sentence-parsing  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2021-09-27. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2021-3828 · Severity: low · CVSS 3.1 · Published 2021-09-27

NLTK is a widely-used natural language processing library. The library contains a regular expression denial-of-service (ReDoS) vulnerability in its comparative sentence corpus reader that allows an attacker to cause excessive CPU consumption by providing specially crafted input, potentially disrupting any application using this feature.

Technologies: [nltk (PyPI)](https://junglewise.ai/threats/technologies/nltk). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2021-3828 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2021-3828 being exploited in the wild.

**How severe is CVE-2021-3828?** Low severity, with a CVSS score of 3.1, published 27 September 2021.

**Which products and versions are affected?** nltk (PyPI) ECOSYSTEM:introduced=0,fixed=3.6.4, GIT:introduced=0,fixed=277711ab1dec729e626b27aab6fa35ea5efbd7e6|ECOSYSTEM:introduced=0,fixed=3.6.4.

**Is there a fix for CVE-2021-3828?** Yes. nltk (PyPI): upgrade to 3.6.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2021-3828 attacked?** It is attacked over the network.

**Am I affected by CVE-2021-3828?** Check whether you run nltk (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- nltk (PyPI): upgrade to 3.6.4 or later

  ```sh
  pip install "nltk>=3.6.4"
  ```


## Technical details

NLTK versions prior to 3.6.4 contain a ReDoS vulnerability in the _read_comparison_block() function within nltk/corpus/reader/comparative_sents.py. The vulnerable regular expression is \((?!.*\()(.*)\)$, which uses nested quantifiers that cause exponential backtracking when processing input that nearly matches the pattern. An attacker who can supply input to this function can trigger catastrophic backtracking, causing the application to consume excessive CPU resources. The vulnerability is network-accessible if NLTK is exposed through a web service or API endpoint. A fix was merged in PR #2816 and released in NLTK 3.6.4.

## Affected products

- NLTK NLTK before 3.6.4

## Identifiers

- CVE-2021-3828
- GHSA-2ww3-fxvq-293j
- PYSEC-2021-356

## Timeline

- 2021-09-29: disclosed
- 2021-09-24: patched: Patch merged in PR #2816

## References

- [https://github.com/nltk/nltk/pull/2816](https://github.com/nltk/nltk/pull/2816)

## Related threats

- [NLTK WekaClassifier path traversal in model validation](https://junglewise.ai/threats/cve-2026-109956-nltk-through-3-10-3-contains-a-path-traversal-vulnerability-in)
- [NLTK RecursiveDescentParser uncontrolled recursion denial of service](https://junglewise.ai/threats/cve-2026-12876-nltk-recursivedescentparser-uncontrolled-recursion-denial-of)
- [NLTK tgrep regular expression denial of service](https://junglewise.ai/threats/nltk-tgrep-regular-expression-denial-of-service-02fca1b2)
- [NLTK Downloader hardlink filesystem containment bypass](https://junglewise.ai/threats/nltk-downloader-hardlink-filesystem-containment-bypass-522cb97d)
- [NLTK Pl196xCorpusReader quadratic ReDoS on malformed TEI blocks](https://junglewise.ai/threats/nltk-pl196xcorpusreader-quadratic-redos-on-malformed-tei-blocks-8473e6ef)