AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

NLTKGHSA-rqjh-jp2r-59cj

NLTK Vulnerable to REDoS

NLTK

CVE-2021-3842 · Published Jan 6, 2022 · updated Sep 26, 2024

High7.5
Fix: upgrade to 3.6.6 or later
GitHub advisory

NLTK is vulnerable to REDoS in some RegexpTaggers used in the functions get_pos_tagger and malt_regex_tagger.

Affected versions

PackageAffectedFixed in
nltk
PyPI
< 3.6.63.6.6
Details and references
CVSS 3.0
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Severity from
GitHub (reviewed advisory)
Weakness
CWE-1333
Also known as
CVE-2021-3842, PYSEC-2022-5

More NLTK advisories

All NLTK
High 8.6Mar 4NLTK has a Path Traversal issueCVE-2026-0847fixed in 3.9.3Critical 10.0Feb 18NLTK has a Zip Slip VulnerabilityCVE-2025-14009fixed in 3.9.3High 7.5Jun 28, 2024ntlk unsafe deserialization vulnerabilityCVE-2024-39705fixed in 3.9High 7.5Jan 6, 2022Inefficient Regular Expression Complexity in nltk (word_tokenize, sent_tokenize)CVE-2021-43854fixed in 3.6.6High 7.5Sep 29, 2021NLTK Vulnerable to REDoSCVE-2021-3828fixed in 3.6.4High 7.5Aug 23, 2019NLTK Vulnerable To Path TraversalCVE-2019-14751fixed in 3.4.5