GHSA-vf76-f5cp-9846: Medium severity pip/nltk vulnerability
Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-w3v8-gmh9-3wv7. This link is maintained to preserve external references.
Original Description NLTK before 3.10.3 contains a regular expression denial of service (ReDoS) vulnerability in the tgrep module. The tgrepnodeaction function compiles user-supplied regular expressions embedded in /regex/ pattern nodes and executes them via re.search against tree node labels without any validation or timeout. An attacker who controls the tgrep pattern (e.g., via tgreppositions() or tgrepcompile() exposed to external input) can supply a pattern that triggers catastrophic backtracking, causing indefinite CPU saturation that blocks the Python process.
Affected Software
Event History
Frequently Asked Questions
Is this advisory still the authoritative source for the issue?
No. This advisory was withdrawn as a duplicate of GHSA-w3v8-gmh9-3wv7 and is retained only to preserve external references.
What conditions are required for exploitation?
An attacker must be able to control a tgrep pattern passed through an externally exposed path such as tgrep_positions() or tgrep_compile(). The malicious pattern must include a /regex/ pattern node that causes catastrophic backtracking when matched against tree node labels.
What is the practical impact?
A successful attack can cause indefinite CPU saturation and block the affected Python process. The stated impact is availability only; no confidentiality or integrity impact is identified.
Are applications affected by default?
The issue is relevant when an application accepts untrusted tgrep patterns and evaluates them. The provided information does not establish that every default NLTK deployment exposes such input handling.