CyberRota Analysis
AI-GeneratedThe tgrep module in NLTK versions prior to 3.10.3 is vulnerable to a regular expression denial of service (ReDoS) attack due to improper handling of user-supplied regex patterns, which can lead to excessive CPU consumption and process blocking. This vulnerability poses a risk to any application utilizing NLTK for text processing, particularly those that expose tgrep functions to external input. Organizations using affected versions should prioritize updating to mitigate potential service disruptions.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
NLTK before 3.10.3 contains a regular expression denial of service (ReDoS) vulnerability in the tgrep module. The _tgrep_node_action function compiles user-supplied regular expressions embedded in /regex/ pattern nodes and executes them via re.search against tree node labels without any validation or timeout. An attacker who controls the tgrep pattern (e.g., via tgrep_positions() or tgrep_compile() exposed to external input) can supply a pattern that triggers catastrophic backtracking, causing indefinite CPU saturation that blocks the Python process.
Related CVEs
Other vulnerabilities affecting the same vendor(s)