CVE-2021-3828: Inefficient Regular Expression Complexity in nltk
Summary
CVE-2021-3828: nltk is vulnerable to Inefficient Regular Expression Complexity. Affects nltk across 2 version ranges.
< 3.6.4
< 277711ab1dec729e626b27aab6fa35ea5efbd7e6
Fixed in 277711ab1dec729e626b27aab6fa35ea5efbd7e6. How to fix ↓
Also tracked for
- nltk · Debian:11
The same CVE-2021-3828 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
nltk is a Python package available on PyPI that provides natural language processing capabilities. It is widely used for tasks such as tokenization, stemming, tagging, and parsing. The package is known for its extensive collection of corpora, lexical resources, and algorithms. However, nltk is vulnerable to an issue related to inefficient regular expression complexity.
Vulnerability Detail
The vulnerability in nltk arises from the inefficient complexity of regular expressions used in certain operations. This can lead to excessive backtracking and cause the application to consume excessive CPU resources or hang indefinitely. An attacker could potentially exploit this vulnerability to launch denial-of-service attacks against systems that utilize nltk for natural language processing. The vulnerability was identified as CVE-2021-3828 and has been assigned the identifier PYSEC-2021-356.
How To Fix
Latest published version: 3.10.4 as of 22 Oct 2026
pip install --upgrade "nltk==3.10.4"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
277711ab1dec729e626b27aab6fa35ea5efbd7e6
This is the first release that contains the fix.
pip install --upgrade "nltk==277711ab1dec729e626b27aab6fa35ea5efbd7e6"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating the nltk package is not immediately feasible, a temporary workaround can be implemented by avoiding or limiting the use of the affected operations that involve regular expressions. Developers can review their codebase and identify areas where nltk regular expressions are used extensively and consider alternative approaches or optimizations. Here's an example of how to avoid the affected operation:
import nltk
Avoiding the affected operation
if not nltk.inefficient_regex_operation(): # Perform the regular expression operation nltk.perform_regex_operation()
Conclusion
In summary, nltk is vulnerable to inefficient regular expression complexity, which can result in excessive CPU resource consumption or application hang. It is crucial to update the nltk package to version 3.6.4 or later to mitigate this vulnerability. If immediate update is not possible, developers can implement workarounds by avoiding or limiting the use of affected operations involving regular expressions. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for nltk →
FAQ
nltk is a Python package that provides natural language processing capabilities, including tokenization, stemming, tagging, and parsing. It is widely used in various applications for text analysis and processing.
The vulnerability in nltk can lead to excessive CPU resource consumption or application hang due to inefficient regular expression complexity. This can be exploited by attackers to launch denial-of-service attacks against systems using nltk.
To fix this vulnerability, update the nltk package to version 3.6.4 or later using the command 'pip install --upgrade nltk'. This version includes a fix for the inefficient regular expression complexity issue.
If immediate package update is not possible, developers can avoid or limit the use of affected operations involving regular expressions in nltk. They can review their codebase and consider alternative approaches or optimizations.
You can find more information about this vulnerability in the nltk package on the official GitHub repository (https://github.com/nltk/nltk) and the PyPA advisory database (https://github.com/pypa/advisory-database/blob/main/vulns/nltk/PYSEC-2021-356.yaml).
References
Related vulnerabilities
Recent vulnerabilities recorded for nltk.
