PT-2021-22014 · Pypi+3 · Nltk+3

Srikanth Prathi + 1 · Published 2021-09-27 · Updated 2025-05-17 · CVE-2021-3828

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions: nltk (affected versions not specified)

Description: The nltk package is vulnerable to ReDoS (regular expression denial of service). An attacker that is able to provide input to the checkComparisonBlock() function, specifically the read comparison block() function in the file nltk/corpus/reader/comparative sents.py, may cause an application to consume an excessive amount of CPU.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

DoS

Weakness Enumeration

CWE-697

CWE-1333

Related Identifiers

CVE-2021-3828

GHSA-2WW3-FXVQ-293J

MGASA-2023-0302

OPENSUSE-SU-2022:10040-1

OPENSUSE-SU-2024:11958-1

OPENSUSE-SU-2025:15099-1

PYSEC-2021-356

USN-5215-1

Affected Products

Debian

Linuxmint

Ubuntu

Nltk

References · 31

• 🔥 https://huntr.dev/bounties/d19aed43-75bc-4a03-91a0-4d0bb516bc32 · Exploit
• https://github.com/nltk/nltk/commit/277711ab1dec729e626b27aab6fa35ea5efbd7e6 · Patch
• https://osv.dev/vulnerability/openSUSE-SU-2024:11958-1 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2021-356 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2023-0302 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-3828 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-3828 · Vendor Advisory
• https://osv.dev/vulnerability/USN-5215-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-3828 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:15099-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-3828 · Security Note
• https://osv.dev/vulnerability/GHSA-2ww3-fxvq-293j · Vendor Advisory
• https://ubuntu.com/security/notices/USN-5215-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-3828 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2022:10040-1 · Vendor Advisory