Skip to content
OpenAdvisories
High USN-7365-1 2 CVEs

nltk vulnerabilities

Published Mar 24, 2025 · Updated Jun 25, 2026

Ecosystem: Ubuntu

Summary

It was discovered that NLTK contained a regex that is susceptible to
catastrophic backtracking. An attacker could possibly use this issue to
cause a denial of service. (CVE-2021-3842, CVE-2021-43854)

Fixed packages 4

ReleasePackageFixed in
Ubuntu · Pro 14.04 LTS Pro:14.04:LTS nltk 2.0~b9-0ubuntu4.1~esm4
Ubuntu · Pro 16.04 LTS Pro:16.04:LTS nltk 3.1-1ubuntu0.1+esm2
Ubuntu · Pro 18.04 LTS Pro:18.04:LTS nltk 3.2.5-1ubuntu0.1+esm2
Ubuntu · Pro 20.04 LTS Pro:20.04:LTS nltk 3.4.5-2ubuntu0.1~esm2

Vulnerabilities 2

  • High 7.5
    CVE-2021-3842

    Inefficient Regular Expression Complexity in nltk/nltk

    nltk is vulnerable to Inefficient Regular Expression Complexity

    nltk nltk/nltk nltk nltk Debian Ubuntu PyPI
  • High 7.5
    CVE-2021-43854

    Inefficient Regular Expression Complexity in nltk

    NLTK (Natural Language Toolkit) is a suite of open source Python modules, data sets, and tutorials supporting research and development in Natural Language Processing. Versions prior to 3.6.5 are vulnerable to regular expression denial of service (ReDoS) attac…

    nltk nltk nltk nltk Debian Ubuntu PyPI

References

  • report
    https://ubuntu.com/security/CVE-2021-3842
  • report
    https://ubuntu.com/security/CVE-2021-43854