AIKIDO-2026-61660
nltk is vulnerable to Regular Expression Denial of Service (ReDoS)
53
Medium Risk
This Affects:
nltkTL;DR
The TweetTokenizer URL and email sub-patterns in casual.py build WORD_RE from unbounded quantifiers that backtrack catastrophically on long dotted input. Tokenizing untrusted text such as a short repeated a. sequence drives super-quadratic CPU growth, making a few kilobytes of input hang the tokenizer for seconds to minutes. Because TweetTokenizer and casual_tokenize are meant to run on user-generated text, a single crafted token denies service to the processing thread. The fix bounds the URL and email sub-patterns to realistic DNS and RFC length caps so tokenization output is unchanged but matching time becomes linear.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you tokenize untrusted text with TweetTokenizer or casual_tokenize.
Background info
nltk is vulnerable to Regular Expression Denial of Service (ReDoS) in versions 3.0.5 - 3.10.0.
How to fix this
Upgrade the nltk library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant