Description

NLTK before 3.10.3 contains a regular expression denial of service (ReDoS) vulnerability in the tgrep module. The _tgrep_node_action function compiles user-supplied regular expressions embedded in /regex/ pattern nodes and executes them via re.search against tree node labels without any validation or timeout. An attacker who controls the tgrep pattern (e.g., via tgrep_positions() or tgrep_compile() exposed to external input) can supply a pattern that triggers catastrophic backtracking, causing indefinite CPU saturation that blocks the Python process.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.9",
  "pubDate": "2026-08-26T11:16:40.103Z",
  "pubdate": "2026-08-26T11:16:40.103Z",
  "executiveSummary": "The NLTK library (versions prior to 3.10.3) is susceptible to a Regular Expression Denial of Service (ReDoS) vulnerability located within its tgrep module.\nThe vulnerability arises from the insecure handling of user-supplied regular expressions within the _tgrep_node_action function, which utilizes the re.search method without input validation or execution timeouts.\nBy crafting a malicious regular expression pattern, an attacker can trigger catastrophic backtracking during the matching process against tree node labels.\nThe primary impact is a total denial of service caused by indefinite CPU saturation, effectively hanging the Python process executing the NLTK code.\nThis vulnerability poses a significant risk to applications that process untrusted input via tgrep_positions() or tgrep_compile(), as it allows unauthenticated remote attackers to exhaust server resources.\nNo specific privileges are required to exploit this flaw, provided the attacker can influence the pattern passed to the vulnerable functions.",
  "technicalDetails": "The root cause of this vulnerability lies in the implementation of the tgrep module's regex processing engine, specifically within the _tgrep_node_action function. This function dynamically compiles and executes regex patterns provided by the user to filter or locate nodes within a tree structure. Because the library fails to sanitize these inputs or implement execution limits, it relies on the standard Python re module's regex engine, which is susceptible to linear-exponential time complexity when encountering complex, ambiguous regex patterns.\nExploitation occurs when an attacker supplies a crafted 'pathological' regular expression that causes catastrophic backtracking. When the engine attempts to match such a pattern against tree node labels, the nested quantifiers or overlapping groups in the malicious regex force the engine to evaluate an exponential number of possible paths. Since Python's re engine is single-threaded and lacks built-in timeout mechanisms for regex operations, the process enters an infinite loop of heavy CPU usage.\nThe attack flow proceeds as follows: First, the attacker identifies an application endpoint that accepts user input and passes it into NLTK's tgrep_positions() or tgrep_compile() functions. Second, the attacker crafts a payload containing a regex string designed to trigger backtracking, such as patterns involving repeated nested groups (e.g., '(a+)+$'). Third, the application forwards this payload to the _tgrep_node_action function. Finally, when the function executes re.search, the regex engine hangs while attempting to resolve the match, consuming 100% of the allocated CPU core and rendering the application unresponsive.\nThis vulnerability impacts NLTK versions prior to 3.10.3. The lack of validation implies that any data source—ranging from web form submissions to API parameters—that is fed into the tgrep module serves as an attack vector. The consequence of a successful exploitation is a complete service disruption for the affected process. Because the underlying issue is inherent to the use of backtracking regex engines on untrusted input, the vulnerability is not restricted to specific privilege levels, making it highly accessible for adversaries seeking to induce downtime."
}