Executive brief
NLTK is a popular Python library for natural language processing, used to analyze and process text data in applications. The Text.findall() method accepts user-supplied regular expressions without validation or timeout protections. An attacker can supply specially crafted regex patterns that trigger catastrophic backtracking, causing the Python process to consume 100% CPU indefinitely and denying service to all legitimate users of that application.
Technical details
This is a Regular Expression Denial of Service (ReDoS) vulnerability in NLTK's nltk.text.Text.findall() and TokenSearcher.findall() methods. The vulnerability exists because these methods accept user-controlled regular expressions and pass them directly to Python's re.findall() engine without validation, timeout, or protection against catastrophic backtracking patterns. While the code performs some preprocessing on angle-bracket syntax, it does not inspect or reject patterns prone to exponential backtracking. An unauthenticated, network-connected attacker with ability to supply input to these methods can trigger indefinite CPU saturation. The vulnerability was patched in NLTK 3.10.0 (commit d8e4753).
Affected products
- NLTK NLTK before 3.10.0 (all versions up to and including 3.9.4)
Timeline
- 2026-08-12: disclosed
- 2026-08-12: patched: Fixed in NLTK 3.10.0