Regular Expression Denial of Service in NLTK

Executive Summary

This is a regular expression denial of service (ReDoS) vulnerability in NLTK versions before 3.10.0. The Text.findall() and TokenSearcher.findall() methods accept user-supplied regular expressions without validation or timeout. Attackers can craft regex patterns that cause catastrophic backtracking, leading to indefinite CPU saturation and denial of service for all users of the Python process.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check the installed NLTK version using 'pip show nltk' or 'python -c "import nltk; print(nltk.__version__)"'. If the version is below 3.10.0, the system is vulnerable. Monitor for unusual CPU usage spikes during regex operations in Python processes.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to cause high CPU usage, making the system unresponsive or crashing it. This affects all users of the Python process running vulnerable NLTK versions, potentially disrupting services relying on text processing.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update NLTK to version 3.10.0 or later using 'pip install --upgrade nltk'. If updating is not possible, restrict user input to regex patterns or implement custom validation to prevent catastrophic backtracking.

Useful 0 Not Useful 0