PT-2022-10719 · Nltk+3 · Nltk+3

Tomaarsen · Published 2022-01-04 · Updated 2025-03-24 · CVE-2021-3842

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions nltk (affected versions not specified)

Description The issue concerns Inefficient Regular Expression Complexity, also known as ReDoS, in certain RegexpTaggers used within the get pos tagger and malt regex tagger functions.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

DoS

Weakness Enumeration

CWE-1333

Related Identifiers

CVE-2021-3842

GHSA-RQJH-JP2R-59CJ

PYSEC-2022-5

USN-7365-1

Affected Products

Debian

Linuxmint

Ubuntu

Nltk

References · 19

• 🔥 https://huntr.dev/bounties/761a761e-2be2-430a-8d92-6f74ffe9866a · Exploit
• https://github.com/nltk/nltk/commit/2a50a3edc9d35f57ae42a921c621edc160877f4d · Patch
• https://osv.dev/vulnerability/CVE-2021-3842 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2021-3842 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-3842 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-3842 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-3842 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-3842 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-rqjh-jp2r-59cj · Vendor Advisory
• https://ubuntu.com/security/notices/USN-7365-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-43854 · Vendor Advisory
• https://osv.dev/vulnerability/USN-7365-1 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2022-5 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-3842 · Vendor Advisory
• https://github.com/nltk/nltk · Note