CyberRota Analysis
AI-GeneratedNLTK versions prior to 3.10.3 are susceptible to a regular expression denial of service vulnerability within the Pl196xCorpusReader, which can be exploited by attackers through malformed TEI blocks containing unmatched opening tags. This flaw allows for significant CPU resource consumption due to inefficient regex processing, potentially leading to service degradation. Organizations utilizing NLTK for text processing should prioritize updating to mitigate the risk of performance issues from this vulnerability.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
NLTK before 3.10.3 contains a regular expression denial of service vulnerability in Pl196xCorpusReader that allows attackers to cause quadratic CPU consumption by supplying malformed TEI blocks with many unmatched opening tags. Attackers can exploit lazy regex patterns in the read_block method through public APIs like words() and tagged_words() to force repeated rescans and achieve near-quadratic runtime growth.
Related CVEs
Other vulnerabilities affecting the same vendor(s)