CVE-2021-3828: Inefficient Regular Expression in nltk
Summary
CVE-2021-3828: NLTK Vulnerable to REDoS. Affects nltk versions < 3.6.4. Fixed in 3.6.4. How to fix ↓
Also tracked for
- nltk · Debian:11
The same CVE-2021-3828 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The nltk package is a Python library used for natural language processing tasks. It provides various functionalities for tokenization, stemming, tagging, parsing, and more. The package is widely used in applications that require text analysis and processing. However, nltk is vulnerable to regular expression denial of service attacks due to an inefficient regular expression implementation.
Vulnerability Detail
The vulnerability in nltk arises from an inefficient regular expression used in the nltk.corpus.reader.comparative_sents.KEYWORD function. This vulnerability can be exploited by an attacker to launch regular expression denial of service (ReDoS) attacks. By providing specially crafted input, an attacker can cause the function to consume excessive CPU resources, leading to a denial of service condition. This can impact the availability and performance of applications that utilize the nltk package.
How To Fix
Latest published version: 3.10.4 as of 22 Oct 2026
pip install --upgrade "nltk==3.10.4"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.6.4
This is the first release that contains the fix.
pip install --upgrade "nltk==3.6.4"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. However, users can mitigate the risk by ensuring they have the latest version of the nltk package installed. Additionally, it is recommended to implement input validation and sanitization techniques to prevent malicious inputs from triggering the vulnerable regular expression.
Conclusion
The vulnerability in nltk due to an inefficient regular expression implementation can lead to regular expression denial of service attacks. It is crucial to update the nltk package to the latest version and implement proper input validation to mitigate the risk. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for nltk →
FAQ
nltk is a Python library used for natural language processing tasks such as tokenization, stemming, tagging, and parsing.
Regular expression denial of service (ReDoS) is a type of attack where an attacker provides input that causes a regular expression to take an excessive amount of time to process, leading to a denial of service condition.
The vulnerability in nltk can impact the availability and performance of applications that utilize the package. An attacker can exploit the vulnerability to launch ReDoS attacks, causing the application to consume excessive CPU resources and potentially leading to a denial of service.
To fix the vulnerability, update the nltk package to version 3.6.4 or later using the package manager of your Python environment.
While there are no specific workarounds provided, you can mitigate the risk by ensuring you have the latest version of the nltk package installed and implementing input validation and sanitization techniques.
References
Related vulnerabilities
Recent vulnerabilities recorded for nltk.
