Vulnerability in nltk (CVE-2021-43854)
Summary
Vulnerability in nltk (CVE-2021-43854). Risk of unauthorized operations or information disclosure. Exploitable via PunktSentenceTokenizer. Mitigation: upgrade to 3.6.6 or later.
Original description
The description as published by the source.
Impact
The vulnerability is present in PunktSentenceTokenizer, sent_tokenize and word_tokenize. Any users of this class, or these two functions, are vulnerable to a Regular Expression Denial of Service (ReDoS) attack.
In short, a specifically crafted long input to any of these vulnerable functions will cause them to take a significant amount of execution time. The effect of this vulnerability is noticeable with the following example:
from nltk.tokenize import word_tokenize
n = 8
for length in [10**i for i in range(2, n)]:
# Prepare a malicious input
text = "a" * length
start_t = time.time()
# Call `word_tokenize` and naively measure the execution time
word_tokenize(text)
print(f"A length of {length:<{n}} takes {time.time() - start_t:.4f}s")
Which gave the following output during testing:
A length of 100 takes 0.0060s
A length of 1000 takes 0.0060s
A length of 10000 takes 0.6320s
A length of 100000 takes 56.3322s
...
I canceled the execution of the program after running it for several hours.
If your program relies on any of the vulnerable functions for tokenizing unpredictable user input, then we would strongly recommend upgrading to a version of NLTK witho…
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Auto-generated summary
Assembled by SecPulse from the source data (CVSS, CWE, affected versions) using templates — no AI involved. Check the original description and references below for exact details.
A vulnerability tracked as CVE-2021-43854 has been found in nltk.
Attackers can target a specific entry point like PunktSentenceTokenizer over the network to misuse the product.
Risk of unauthorized operations or information disclosure.
What to do: upgrade nltk to 3.6.6 or later.
If unsure, ask your IT team or search "nltk CVE-2021-43854" on the vendor's site.
CVE-2021-43854 (nltk) — CWE-400
Attack vector: remote (network-reachable) / unauthenticated / no user interaction
Attack surface: PunktSentenceTokenizer / sent_tokenize / word_tokenize
Patched: 3.6.6 — apply immediately
Workaround: The execution time of the vulnerable functions is exponential to the length of a malicious input.
Plan: 1) Audit SBOM/dependencies, 2) Stage→prod upgrade, 3) Add WAF/proxy monitoring on affected endpoints, 4) Hunt IOCs in logs.
Refs: see the GHSA / vendor advisory / patched release linked on this page.
A vulnerability (CWE-400) exists in nltk. Attackers reach the vulnerable code path via PunktSentenceTokenizer without authentication.
Check the vendor advisory for the affected versions of nltk. Attack surface: PunktSentenceTokenizer / sent_tokenize / word_tokenize.
Severity: ?. Risk of unauthorized operations or information disclosure.
Update to 3.6.6.
Workaround: The execution time of the vulnerable functions is exponential to the length of a malicious input.
Search webserver/proxy logs for unusual request patterns matching this CVE's known IOCs. Run grep -r 'nltk' . against your dependency files (package-lock.json, requirements.txt, go.sum) to find affected services.
Response actions
Concrete steps and command examples for SOC/SRE teams to execute in order
-
1Identify exposure identify
grep -r 'nltk' . | grep -v node_modulesリポジトリと本番環境の依存ファイル (package-lock.json / requirements.txt / go.sum / Gemfile.lock 等) で
nltkを grep し、稼働しているサービス・バージョンを把握する。 -
2Apply temporary workaround mitigate
The execution time of the vulnerable functions is exponential to the length of a malicious input.パッチが適用されるまでの応急処置として、The execution time of the vulnerable functions is exponential to the length of a malicious input. を実施。回避策の副作用 (機能低下) を確認した上で。
-
3Apply patch patch
Upgrade nltk to 3.6.6ステージング環境で 3.6.6 に上げて回帰テスト → 本番反映。回帰テストはアプリの主要ハッピーパスを含めること。
-
4Post-deployment verification verify
Confirm patched version is live in productionパッチ適用後、ステージングで PoC または同等の悪用パターンを再現して脆弱性が閉じたことを確認。本番ではアクセスログ・WAF でアラート再発が無いか継続監視。
Affected packages
References
- advisory nvd.nist.gov
- package github.com
- web github.com
- web github.com
- web github.com
- web github.com
- web github.com