NLTK Vulnerable to REDoS

2022-01-0622:24:14

Google

osv.dev

0.001 Low

EPSS

Percentile

34.6%

NLTK is vulnerable to REDoS in some RegexpTaggers used in the functions get_pos_tagger and malt_regex_tagger.

CPENameOperatorVersion
nltkeq2.0.1rc2-git
nltkeq3.6.5
nltkeq3.4.2
nltkeq3.2.5
nltkeq3.1
nltkeq3.4.3
nltkeq0.9.5
nltkeq2.0.1
nltkeq3.2.4
nltkeq2.0b7

Name	Operator	Version
nltk	eq	2.0.1rc2-git
nltk	eq	3.6.5
nltk	eq	3.4.2
nltk	eq	3.2.5
nltk	eq	3.1
nltk	eq	3.4.3
nltk	eq	0.9.5
nltk	eq	2.0.1
nltk	eq	3.2.4
nltk	eq	2.0b7

Rows per page:

1-10 of 541

References

github.com/nltk/nltk

github.com/nltk/nltk/commit/2a50a3edc9d35f57ae42a921c621edc160877f4d

github.com/nltk/nltk/pull/2906

huntr.dev/bounties/761a761e-2be2-430a-8d92-6f74ffe9866a

nvd.nist.gov/vuln/detail/CVE-2021-3842

0.001 Low

EPSS

Percentile

34.6%

Related for OSV:GHSA-RQJH-JP2R-59CJ