Executive brief
NLTK is a widely-used Python library for natural language processing. The Text.findall() and TokenSearcher.findall() methods accept user-supplied regular expression patterns without timeout protection or complexity validation. An attacker can supply a crafted regex pattern with nested quantifiers that causes catastrophic backtracking, consuming 100% CPU indefinitely and freezing all users of the affected Python process.
Technical details
The vulnerability is a regular expression denial of service (ReDoS, CWE-1333) in the nltk.text module. The vulnerable code is in TokenSearcher.findall() (line 255) and Text.findall() (line 620), which accept user-supplied regex patterns and pass them directly to Python's re.findall() without timeout protection or backtracking complexity validation. The preprocessing applies only syntactic transformations (angle-bracket conversions) but does not inspect or reject patterns with nested quantifiers prone to catastrophic backtracking. An unauthenticated attacker can exploit this over the network if the application exposes findall() to external input. The attack causes exponential state enumeration in the regex engine, pinning the CPU at 100% indefinitely. The vulnerability was patched in version 3.10.0 (commit d8e4753), which replaces the stdlib re module with the regex library that supports timeout parameters and raises TimeoutError instead of hanging.
Affected products
- NLTK Project NLTK <= 3.9.4
Timeline
- 2026-08-26: disclosed
- 2026-08-12: patched: Patched in version 3.10.0 (commit d8e4753)