NLTK Regex DoS in Pl196xCorpusReader

Executive Summary

This is a Regular Expression Denial of Service (ReDoS) vulnerability in NLTK versions before 3.10.3. It occurs in the Pl196xCorpusReader component where lazy regex patterns in the read_block method cause quadratic CPU consumption when processing malformed TEI blocks with many unmatched opening tags. Attackers can trigger this through public APIs like words() and tagged_words().

Useful 0 Not Useful 0

Detection Guidance

Check NLTK version with pip show nltk. If version is below 3.10.3, the system is vulnerable. Monitor CPU usage spikes when processing TEI blocks or XML-like files with many unmatched opening tags.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to cause high CPU usage and system slowdowns by providing specially crafted input. This may lead to degraded performance or temporary unavailability of services relying on NLTK for text processing tasks.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it is a performance issue rather than a data protection or privacy breach. Standards like GDPR focus on unauthorized data access or processing, while HIPAA addresses protected health information safeguards. This ReDoS issue primarily impacts system availability and performance.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade NLTK to version 3.10.3 or later using pip install --upgrade nltk. Avoid processing untrusted TEI blocks or XML-like files with many unmatched opening tags until patched.

Useful 0 Not Useful 0