CVE-2021-3842: Inefficient Regular Expression Complexity in nltk/nltk
Last updated 24 March 2025
Other sources
nltk is vulnerable to Inefficient Regular Expression Complexity
— MITRE
NLTK is vulnerable to REDoS in some RegexpTaggers used in the functions getpostagger and maltregextagger.
— GitHub
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2021-3842?
CVE-2021-3842 is a vulnerability in NLTK that allows for Regular Expression Denial of Service (REDoS) attacks in certain RegexpTaggers used in the functions `get_pos_tagger` and `malt_regex_tagger`.
How severe is CVE-2021-3842?
CVE-2021-3842 has a severity score of 7.5, which is considered high.
What software is affected by CVE-2021-3842?
NLTK version 3.6.6 installed through pip is affected by CVE-2021-3842.
How can I fix CVE-2021-3842?
To fix CVE-2021-3842, update NLTK to version 3.6.6 using pip.
Where can I find more information about CVE-2021-3842?
You can find more information about CVE-2021-3842 at the following references: [NVD](https://nvd.nist.gov/vuln/detail/CVE-2021-3842), [NLTK GitHub Commit](https://github.com/nltk/nltk/commit/2a50a3edc9d35f57ae42a921c621edc160877f4d), [Huntr Bounty](https://huntr.dev/bounties/761a761e-2be2-430a-8d92-6f74ffe9866a).