PT-2021-23980 · Nltk+3 · Nltk+3

Tomaarsen · Published 2021-12-23 · Updated 2025-03-24 · CVE-2021-43854

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions: NLTK versions prior to 3.6.5

Description: The issue is related to regular expression denial of service (ReDoS) attacks, which can cause significant execution time when a specifically crafted long input is provided to vulnerable functions. The vulnerability is present in PunktSentenceTokenizer, sent tokenize, and word tokenize. Any users of this class or these two functions are vulnerable to the ReDoS attack. If a program relies on any of the vulnerable functions for tokenizing unpredictable user input, upgrading to a version of NLTK without the vulnerability is strongly recommended.

Recommendations: For versions prior to 3.6.5, upgrade to NLTK 3.6.6 or later to resolve the issue. As a temporary workaround for users unable to upgrade, limit the maximum length of an input to any of the vulnerable functions to bound the execution time.

Exploit

Fix

DoS

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

CVE-2021-43854

GHSA-F8M6-H2C7-8H9X

PYSEC-2021-859

USN-7365-1

Affected Products

Debian

Linuxmint

Nltk

Ubuntu

References · 19

• 🔥 https://github.com/nltk/nltk/pull/2869 · Exploit
• 🔥 https://github.com/nltk/nltk/security/advisories/GHSA-f8m6-h2c7-8h9x · Exploit
• 🔥 https://github.com/nltk/nltk/issues/2866 · Exploit
• https://github.com/nltk/nltk/commit/1405aad979c6b8080dbbc8e0858f89b2e3690341 · Patch
• https://osv.dev/vulnerability/CVE-2021-43854 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-43854 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-43854 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2021-43854 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-43854 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-7365-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-43854 · Vendor Advisory
• https://osv.dev/vulnerability/USN-7365-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-43854 · Security Note
• https://osv.dev/vulnerability/PYSEC-2021-859 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-f8m6-h2c7-8h9x · Vendor Advisory