Description

NLTK before 3.10.3 contains a regular expression denial of service vulnerability in Pl196xCorpusReader that allows attackers to cause quadratic CPU consumption by supplying malformed TEI blocks with many unmatched opening tags. Attackers can exploit lazy regex patterns in the read_block method through public APIs like words() and tagged_words() to force repeated rescans and achieve near-quadratic runtime growth.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.7",
  "pubDate": "2026-08-27T17:21:03.247Z",
  "pubdate": "2026-08-27T17:21:03.247Z",
  "executiveSummary": "A Regular Expression Denial of Service (ReDoS) vulnerability exists in NLTK versions prior to 3.10.3 within the Pl196xCorpusReader component.\nThe vulnerability stems from the use of inefficient, lazy regex patterns within the read_block method, which processes TEI-formatted corpus data.\nAn attacker can exploit this by providing malformed TEI blocks containing a high density of unmatched opening tags.\nSuccessful exploitation forces the regular expression engine into a state of exponential backtracking, leading to near-quadratic CPU consumption.\nThis impact results in severe resource exhaustion, potentially rendering the application unresponsive during the processing of malicious inputs.\nThe vulnerability is exploitable through common public APIs such as words() and tagged_words(), which trigger the internal read_block logic.\nNo specific authentication or elevated privileges are required to initiate the attack, provided the adversary can supply data to the NLTK corpus reader.\nThe primary risk is a targeted Denial of Service (DoS) against systems that process user-supplied or untrusted TEI corpus data using the affected NLTK functions.",
  "technicalDetails": "The vulnerability is rooted in the implementation of the read_block method within the Pl196xCorpusReader class of the NLTK library.\nThis component utilizes regular expressions to parse TEI (Text Encoding Initiative) structures. The specific regex implementation employs lazy quantifiers that fail to terminate efficiently when encountering pathological, malformed, or highly nested tag structures.\nThe root cause is a catastrophic backtracking scenario. When the regex engine attempts to match patterns against input containing a large number of unmatched opening tags, the lazy matching logic repeatedly re-evaluates segments of the input string to satisfy the regex constraints.\nBecause the regex complexity scales quadratically with the depth or density of the unmatched tags, the CPU usage spikes significantly as the engine attempts to resolve the ambiguity of the lazy patterns.\nThe attack flow begins when an attacker provides a crafted input file or stream to an NLTK-based application. The application, in turn, invokes high-level functions such as words() or tagged_words() to process the corpus.\nThese functions call the internal read_block method, which feeds the malicious content into the flawed regex engine.\nAs the parser attempts to tokenize or extract content from the TEI blocks, the engine enters a loop of repeated rescans. The quadratic runtime growth leads to an immediate and sustained increase in CPU utilization.\nGiven that this process typically runs synchronously in standard NLTK usage, the application thread effectively hangs until the regex engine either completes the exhaustive match or times out, resulting in a system-wide or process-specific Denial of Service.\nThe vulnerability affects NLTK versions before 3.10.3. Exposure is contingent upon the application's design to parse external or untrusted text corpus data using the Pl196xCorpusReader. No network-level mitigation is provided by the library itself, and standard regex timeouts are not natively applied to these internal parsing calls by default, making the application highly susceptible to resource exhaustion if it handles untrusted data."
}