CVE-2021-3828: Inefficient Regular Expression Complexity in nltk/nltk
nltk is vulnerable to Inefficient Regular Expression Complexity
Other sources
The nltk package is vulnerable to ReDoS (regular expression denial of service). An attacker that is able to provide as an input to the [readcomparisonblock()(https://github.com/nltk/nltk/blob/23f4b1c4b4006b0cb3ec278e801029557cec4e82/nltk/corpus/reader/comparativesents.py#L259) function in the file nltk/corpus/reader/comparativesents.py may cause an application to consume an excessive amount of CPU.
— GitHub
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/nltkto a version that resolves this vulnerability.Fixed in 3.6.4
Event History
Frequently Asked Questions
What is CVE-2021-3828?
CVE-2021-3828 is a vulnerability in the nltk package that allows for ReDoS (regular expression denial of service) attacks.
What is the severity of CVE-2021-3828?
CVE-2021-3828 has a severity rating of 7.5 (high).
Which software is affected by CVE-2021-3828?
The nltk package version up to and including 3.6.4 is affected by CVE-2021-3828.
How can I fix CVE-2021-3828?
To fix CVE-2021-3828, update the nltk package to version 3.6.5 or later.
What is ReDoS?
ReDoS stands for regular expression denial of service, a type of attack that exploits inefficient regular expressions to cause a denial of service.