CVE-2021-3842: Inefficient Regular Expression Complexity in nltk
Summary
CVE-2021-3842: nltk is vulnerable to Inefficient Regular Expression Complexity. Affects nltk across 2 version ranges.
< 2a50a3edc9d35f57ae42a921c621edc160877f4d
< 3.6.6
Fixed in 2a50a3edc9d35f57ae42a921c621edc160877f4d. How to fix ↓
Also tracked for
- nltk · Debian:11
The same CVE-2021-3842 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
nltk is a Python package available on PyPI that provides natural language processing (NLP) functionalities. It is widely used for tasks such as tokenization, stemming, tagging, parsing, and semantic reasoning. The package is designed to assist in the development of NLP applications and research. However, nltk is vulnerable to an issue related to inefficient regular expression complexity.
Vulnerability Detail
The vulnerability in nltk arises from the inefficient complexity of regular expressions used in certain operations. This can lead to excessive backtracking and cause the application to consume significant CPU resources and time when processing certain inputs. An attacker could potentially exploit this vulnerability to launch denial-of-service attacks against applications that utilize nltk for NLP tasks. It is important to note that this vulnerability does not directly lead to remote code execution or data leakage.
How To Fix
Latest published version: 3.10.4 as of 22 Oct 2026
pip install --upgrade "nltk==3.10.4"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2a50a3edc9d35f57ae42a921c621edc160877f4d
This is the first release that contains the fix.
pip install --upgrade "nltk==2a50a3edc9d35f57ae42a921c621edc160877f4d"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a workaround, if immediate upgrade to the fixed version is not feasible, developers can consider implementing input validation and limiting the complexity of regular expressions used in their application's nltk operations. By carefully crafting regular expressions and validating user input, the impact of this vulnerability can be mitigated.
Conclusion
The vulnerability in nltk related to inefficient regular expression complexity can be mitigated by updating to version 3.6.6 or later. Alternatively, implementing input validation and limiting regular expression complexity can serve as a temporary workaround. For further assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for nltk →
FAQ
nltk is a Python package that provides natural language processing (NLP) functionalities.
The vulnerability can lead to excessive CPU resource consumption and time delays, potentially enabling denial-of-service attacks.
No, this vulnerability does not directly lead to remote code execution.
To fix this vulnerability, update nltk to version 3.6.6 or later.
As a workaround, implement input validation and limit the complexity of regular expressions used in nltk operations.
References
Related vulnerabilities
Recent vulnerabilities recorded for nltk.
