{"id":"CVE-2021-3828","aliases":["DEBIAN-CVE-2021-3828","EUVD-2021-0147","GHSA-2ww3-fxvq-293j","MGASA-2023-0302","PYSEC-2021-356","UBUNTU-CVE-2021-3828","USN-5215-1","openSUSE-SU-2022:10040-1","openSUSE-SU-2024:11958-1","openSUSE-SU-2025:15099-1"],"status":"published","title":"Inefficient Regular Expression Complexity in nltk/nltk","description":"nltk is vulnerable to Inefficient Regular Expression Complexity","severity":{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.01592,"percentile":0.75856,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-1333","CWE-697"],"published":"2021-09-27T12:25:30Z","modified":"2026-10-23T18:03:31Z","fixes":[{"ecosystem":"PyPI","package":"nltk","fixed_in":["3.6.4"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"nltk","fixed_in":["3.6.5-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"nltk","fixed_in":["3.6.5-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"nltk","fixed_in":["3.6.5-1"],"sources":["osv"]},{"ecosystem":"Mageia:8","package":"python-nltk","fixed_in":["3.6.6-1.mga8"],"sources":["osv"]},{"ecosystem":"Mageia:8","package":"python-regex","fixed_in":["2022.9.13-1.mga8"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"nltk","fixed_in":["3.1-1ubuntu0.1+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"nltk","fixed_in":["3.2.5-1ubuntu0.1+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"nltk","fixed_in":["3.4.5-2ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"nltk","fixed_in":["3.6.5-1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"python-nltk","fixed_in":["3.7-1.1","3.9.1-2.4"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"nltk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.4"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"nltk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.5-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"nltk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.5-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"nltk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.5-1"}]}]},{"source":"osv","ecosystem":"PyPI","package":"nltk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.4"}]}],"versions":["0.8","0.9","0.9.3","0.9.4","0.9.5","0.9.6","0.9.7","0.9.8","0.9.9","2.0.1","2.0.1rc1","2.0.1rc2-git","2.0.1rc3","2.0.1rc4","2.0.2","2.0.3","2.0.4","2.0.5","2.0b4","2.0b5","2.0b6","2.0b7","2.0b8","2.0b9","3.0.0","3.0.0b1","3.0.0b2","3.0.1","3.0.2","3.0.3","3.0.4","3.0.5","3.1","3.2","3.2.1","3.2.2","3.2.3","3.2.4","3.2.5","3.3","3.4","3.4.1","3.4.2","3.4.3","3.4.4","3.4.5","3.5","3.5b1","3.6","3.6.1","3.6.2","3.6.3"]},{"source":"osv","ecosystem":"Mageia:8","package":"python-nltk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.6-1.mga8"}]}]},{"source":"osv","ecosystem":"Mageia:8","package":"python-regex","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2022.9.13-1.mga8"}]}]},{"source":"osv","ecosystem":"PyPI","package":"nltk","ranges":[{"type":"GIT","events":[{"introduced":"0"},{"fixed":"277711ab1dec729e626b27aab6fa35ea5efbd7e6"}]},{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.4"}]}],"versions":["0.8","0.9","0.9.3","0.9.4","0.9.5","0.9.6","0.9.7","0.9.8","0.9.9","2.0.1","2.0.1rc1","2.0.1rc2-git","2.0.1rc3","2.0.1rc4","2.0.2","2.0.3","2.0.4","2.0.5","2.0b4","2.0b5","2.0b6","2.0b7","2.0b8","2.0b9","3.0.0","3.0.0b1","3.0.0b2","3.0.1","3.0.2","3.0.3","3.0.4","3.0.5","3.1","3.2","3.2.1","3.2.2","3.2.3","3.2.4","3.2.5","3.3","3.4","3.4.1","3.4.2","3.4.3","3.4.4","3.4.5","3.5","3.5b1","3.6","3.6.1","3.6.2","3.6.3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"nltk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1-1ubuntu0.1+esm1"}]}],"versions":["3.0.4-1","3.0.5-1","3.1-1","3.1-1ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"nltk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.5-1ubuntu0.1+esm1"}]}],"versions":["3.2.4-1","3.2.5-1","3.2.5-1ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"nltk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.5-2ubuntu0.1~esm1"}]}],"versions":["3.4.5-1","3.4.5-2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"nltk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.5-1"}]}],"versions":["3.5-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"nltk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1-1ubuntu0.1+esm1"}]}],"versions":["3.0.4-1","3.0.5-1","3.1-1","3.1-1ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"nltk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.5-1ubuntu0.1+esm1"}]}],"versions":["3.2.4-1","3.2.5-1","3.2.5-1ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"nltk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.5-2ubuntu0.1~esm1"}]}],"versions":["3.4.5-1","3.4.5-2"]},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP2","package":"python-nltk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7-bp152.3.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-nltk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7-1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-nltk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.1-2.4"}]}]}],"products":[{"vendor":"nltk","product":"nltk"},{"vendor":"nltk","product":"nltk/nltk"}],"references":[{"url":"https://huntr.dev/bounties/d19aed43-75bc-4a03-91a0-4d0bb516bc32","tags":["x_refsource_CONFIRM","x_transferred","Exploit","Patch","Third Party Advisory","fix","web","report"]},{"url":"https://github.com/nltk/nltk/commit/277711ab1dec729e626b27aab6fa35ea5efbd7e6","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-3828","tags":["advisory"]},{"url":"https://github.com/nltk/nltk/pull/2816","tags":["web","report"]},{"url":"https://github.com/advisories/GHSA-2ww3-fxvq-293j","tags":["advisory"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/nltk/PYSEC-2021-356.yaml","tags":["web"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2021-3828","tags":["advisory"]},{"url":"https://github.com/nltk/nltk","tags":["package"]},{"url":"https://advisories.mageia.org/MGASA-2023-0302.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=30604","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-3828","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-5215-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-3828","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/6ZUSFUYB3S2F4VLUQBWFBYRLCIHMR43P/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1146427","tags":["report"]},{"url":"https://bugzilla.suse.com/1191030","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2019-14751","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-3828","tags":["web"]},{"url":"","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/IU7FYQGVQSZK33SCY55RWQPTCX6OVM3Q/","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2021-3828","title":"Inefficient Regular Expression Complexity in nltk/nltk","description":"nltk is vulnerable to Inefficient Regular Expression Complexity","status":"published","published":"2021-09-27T12:25:30Z","modified":"2024-08-03T17:09:09.516Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-1333"],"updated_at":"2026-11-02T14:33:04.020035Z"}],"euvd":[{"id":"EUVD-2021-0147","description":"nltk is vulnerable to Inefficient Regular Expression Complexity","status":"published","published":"2021-09-27T12:25:30Z","modified":"2024-08-03T17:09:09Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-03T03:25:11.376657Z"}],"ghsa":[{"id":"GHSA-2ww3-fxvq-293j","title":"NLTK Vulnerable to REDoS","description":"The nltk package is vulnerable to ReDoS (regular expression denial of service). An attacker that is able to provide as an input to the [`_read_comparison_block()`(https://github.com/nltk/nltk/blob/23f4b1c4b4006b0cb3ec278e801029557cec4e82/nltk/corpus/reader/comparative_sents.py#L259) function in the file `nltk/corpus/reader/comparative_sents.py` may cause an application to consume an excessive amount of CPU.","status":"published","published":"2021-09-29T17:14:53Z","modified":"2024-10-07T15:09:22Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-697","CWE-1333"],"updated_at":"2026-11-02T14:38:08.742903Z"}],"nvd":[{"id":"CVE-2021-3828","description":"nltk is vulnerable to Inefficient Regular Expression Complexity","status":"published","published":"2021-09-27T13:15:07.993Z","modified":"2026-06-17T04:05:51.027Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-1333","CWE-697"],"updated_at":"2026-11-02T14:06:58.933037Z"}],"osv":[{"id":"CVE-2021-3828","description":"nltk is vulnerable to Inefficient Regular Expression Complexity","status":"published","published":"2021-09-27T13:15:07.993Z","modified":"2026-11-10T02:45:18.74839171Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-09T10:53:57.550641Z"},{"id":"DEBIAN-CVE-2021-3828","description":"nltk is vulnerable to Inefficient Regular Expression Complexity","status":"published","published":"2021-09-27T13:15:07.993Z","modified":"2026-10-23T18:03:31.700561819Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:35.521549Z"},{"id":"GHSA-2ww3-fxvq-293j","title":"NLTK Vulnerable to REDoS","description":"The nltk package is vulnerable to ReDoS (regular expression denial of service). An attacker that is able to provide as an input to the [`_read_comparison_block()`(https://github.com/nltk/nltk/blob/23f4b1c4b4006b0cb3ec278e801029557cec4e82/nltk/corpus/reader/comparative_sents.py#L259) function in the file `nltk/corpus/reader/comparative_sents.py` may cause an application to consume an excessive amount of CPU.","status":"published","published":"2021-09-29T17:14:53Z","modified":"2024-10-07T15:22:59.778054Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"},{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-1333","CWE-697"],"updated_at":"2026-11-02T15:46:35.050232Z"},{"id":"UBUNTU-CVE-2021-3828","description":"nltk is vulnerable to Inefficient Regular Expression Complexity","status":"published","published":"2021-09-27T13:15:00Z","modified":"2026-02-04T02:21:20.510303Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:28.526929Z"},{"id":"MGASA-2023-0302","title":"Updated python-nltk package fixes a security vulnerability","description":"python-nltk 3.6.6 update resolves ReDoS opportunity by fixing\nincorrectly specified regex\n","status":"published","published":"2023-10-25T18:17:50Z","modified":"2026-04-16T04:41:44.866074719Z","updated_at":"2026-11-02T15:49:42.684501Z"},{"id":"openSUSE-SU-2022:10040-1","title":"Security update for python-nltk","description":"This update for python-nltk fixes the following issues:\n\nUpdate to 3.7\n\n  - Improve and update the NLTK team page on nltk.org (#2855,\n    #2941)\n  - Drop support for Python 3.6, support Python 3.10 (#2920)\n\n- Update to 3.6.7\n\n  - Resolve IndexError in `sent_tokenize` and `word_tokenize`\n    (#2922)\n\n- Update to 3.6.6\n\n  - Refactor `gensim.doctest` to work for gensim 4.0.0 and up\n    (#2914)\n  - Add Precision, Recall, F-measure, Confusion Matrix to Taggers\n    (#2862)\n  - Added warnings if .zip files exist without any corresponding\n    .csv files. (#2908)\n  - Fix `FileNotFoundError` when the `download_dir` is\n    a non-existing nested folder (#2910)\n  - Rename omw to omw-1.4 (#2907)\n  - Resolve ReDoS opportunity by fixing incorrectly specified\n    regex (#2906, boo#1191030, CVE-2021-3828).\n  - Support OMW 1.4 (#2899)\n  - Deprecate Tree get and set node methods (#2900)\n  - Fix broken inaugural test case (#2903)\n  - Use Multilingual Wordnet Data from OMW with newer Wordnet\n    versions (#2889)\n  - Keep NLTKs 'tokenize' module working with pathlib (#2896)\n  - Make prettyprinter to be more readable (#2893)\n  - Update links to the nltk book (#2895)\n  - Add `CITATION.cff` to nltk (#2880)\n  - Resolve serious ReDoS in PunktSentenceTokenizer (#2869)\n  - Delete old CI config files (#2881)\n  - Improve Tokenize documentation + add TokenizerI as superclass\n    for TweetTokenizer (#2878)\n  - Fix expected value for BLEU score doctest after changes from\n    #2572\n  - Add multi Bleu functionality and tests (#2793)\n  - Deprecate 'return_str' parameter in NLTKWordTokenizer and\n    TreebankWordTokenizer (#2883)\n  - Allow empty string in CFG's + more (#2888)\n  - Partition `tree.py` module into `tree` package + pickle fix\n    (#2863)\n  - Fix several TreebankWordTokenizer and NLTKWordTokenizer bugs\n    (#2877)\n  - Rewind Wordnet data file after each lookup (#2868)\n  - Correct __init__ call for SyntaxCorpusReader subclasses\n    (#2872)\n  - Documentation fixes (#2873)\n  - Fix levenstein distance for duplicated letters (#2849)\n  - Support alternative Wordnet versions (#2860)\n  - Remove hundreds of formatting warnings for nltk.org (#2859)\n  - Modernize `nltk.org/howto` pages (#2856)\n  - Fix Bleu Score smoothing function from taking log(0) (#2839)\n  - Update third party tools to newer versions and removing\n    MaltParser fixed version (#2832)\n  - Fix TypeError: _pretty() takes 1 positional argument but 2\n    were given in sem/drt.py (#2854)\n  - Replace `http` with `https` in most URLs (#2852)\n\n- Update to 3.6.5\n\n  - modernised nltk.org website\n  - addressed LGTM.com issues\n  - support ZWJ sequences emoji and skin tone modifer emoji in\n    TweetTokenizer\n  - METEOR evaluation now requires pre-tokenized input\n  - Code linting and type hinting\n  - implement get_refs function for DrtLambdaExpression\n  - Enable automated CoreNLP, Senna, Prover9/Mace4, Megam,\n    MaltParser CI tests\n  - specify minimum regex version that supports regex.Pattern\n  - avoid re.Pattern and regex.Pattern which fail for Python 3.6,\n    3.7\n\n- Update to 3.6.4\n\n  - deprecate `nltk.usage(obj)` in favor of `help(obj)`\n  - resolve ReDoS vulnerability in Corpus Reader\n  - solidify performance tests\n  - improve phone number recognition in tweet tokenizer\n  - refactored CISTEM stemmer for German\n  - identify NLTK Team as the author\n  - replace travis badge with github actions badge\n  - add SECURITY.md\n\n- Update to 3.6.3\n\n  - Dropped support for Python 3.5\n  - Run CI tests on Windows, too\n  - Moved from Travis CI to GitHub Actions\n  - Code and comment cleanups\n  - Visualize WordNet relation graphs using Graphviz\n  - Fixed large error in METEOR score\n  - Apply isort, pyupgrade, black, added as pre-commit hooks\n  - Prevent debug_decisions in Punkt from throwing IndexError\n  - Resolved ZeroDivisionError in RIBES with dissimilar sentences\n  - Initialize WordNet IC total counts with smoothing value\n  - Fixed AttributeError for Arabic ARLSTem2 stemmer\n  - Many fixes and improvements to lm language model package\n  - Fix bug in nltk.metrics.aline, C_skip = -10\n  - Improvements to TweetTokenizer\n  - Optional show arg for FreqDist.plot, ConditionalFreqDist.plot\n  - edit_distance now computes Damerau-Levenshtein edit-distance\n\n- Update to 3.6.2\n\n  - move test code to nltk/test\n  - fix bug in NgramAssocMeasures (order preserving fix)\n\n- Update to 3.6\n\n  - add support for Python 3.9\n  - add Tree.fromlist\n  - compute Minimum Spanning Tree of unweighted graph using BFS\n  - fix bug with infinite loop in Wordnet closure and tree\n  - fix bug in calculating BLEU using smoothing method 4\n  - Wordnet synset similarities work for all pos\n  - new Arabic light stemmer (ARLSTem2)\n  - new syllable tokenizer (LegalitySyllableTokenizer)\n  - remove nose in favor of pytest\n\n- Update to v3.5\n\n  * add support for Python 3.8\n  * drop support for Python 2\n  * create NLTK's own Tokenizer class distinct from the Treebank\n    reference tokeniser\n  * update Vader sentiment analyser\n  * fix JSON serialization of some PoS taggers\n  * minor improvements in grammar.CFG, Vader, pl196x corpus reader,\n    StringTokenizer\n  * change implementation \u003c= and \u003e= for FreqDist so they are partial\n    orders\n  * make FreqDist iterable\n  * correctly handle Penn Treebank trees with a unlabeled branching\n    top node\n\n- Update to 3.4.5 (boo#1146427, CVE-2019-14751):","status":"published","published":"2022-07-03T14:01:14Z","modified":"2025-05-07T18:10:41.360458Z","updated_at":"2026-11-02T16:58:32.653274Z"},{"id":"openSUSE-SU-2024:11958-1","title":"python310-nltk-3.7-1.1 on GA media","description":"These are all security issues fixed in the python310-nltk-3.7-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:41:40.188685Z","updated_at":"2026-11-02T16:58:35.485255Z"},{"id":"openSUSE-SU-2025:15099-1","title":"python311-nltk-3.9.1-2.4 on GA media","description":"These are all security issues fixed in the python311-nltk-3.9.1-2.4 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-05-17T00:00:00Z","modified":"2026-02-04T02:58:40.112007Z","updated_at":"2026-11-02T16:58:37.399567Z"},{"id":"PYSEC-2021-356","description":"nltk is vulnerable to Inefficient Regular Expression Complexity","status":"published","published":"2021-09-27T13:15:00Z","modified":"2023-11-08T04:06:27.021117Z","updated_at":"2026-11-02T15:52:52.682031Z"},{"id":"USN-5215-1","title":"nltk vulnerability","description":"Srikantha Prathi discovered that NLTK incorrectly handled specially crafted input.\nAn attacker could use this vulnerability to cause a denial of service.\n","status":"published","published":"2022-01-10T20:51:11Z","modified":"2026-06-25T13:30:55.013746709Z","updated_at":"2026-11-02T16:58:15.683829Z"}]}}