Executive brief
The Natural Language Toolkit (NLTK), a popular library for processing human language data, contains a flaw in how it reads certain review datasets. An attacker can provide a specially crafted text file that causes the software to consume excessive processor power, effectively freezing the application. This can lead to a denial-of-service, impacting the availability of services that process user-supplied text data.
Technical details
A Regular Expression Denial of Service (ReDoS) vulnerability exists in NLTK's `ReviewsCorpusReader` due to an inefficient regular expression in the `FEATURES` regex. The sub-pattern used to extract feature labels is unbounded and greedy, leading to quadratic backtracking (O(n²)) when processing long lines that lack the expected trailing bracketed digit (e.g., `[+2]`). An attacker can exploit this by providing a crafted corpus file with extremely long lines, causing the `reviews()`, `features()`, and `sents()` methods to hang and exhaust CPU resources. The issue is fixed in version 3.10.0 by capping the per-label word run.
Affected products
- NLTK Project nltk <= 3.9.4
Timeline
- 2026-06-11: disclosed
- 2026-06-15: advisory: NVD publication
- 2026-07-31: patched: GitHub Advisory updated with patch information