NLTK versions before 3.10.0 contain a regular expression denial of service vulnerability in Text.findall() and TokenSearcher.findall() methods that accept user-supplied regular expressions without validation or timeout. Attackers can supply crafted regex patterns that cause catastrophic backtracking, resulting in indefinite CPU saturation and denial of service to all users of the Python process.

NLTK versions before 3.10.0 are affected by a Regular Expression Denial of Service (ReDoS) vulnerability in the Text.findall() and TokenSearcher.findall() methods. These methods accept user-supplied regular expressions without any validation or timeout mechanisms. Attackers can craft malicious regex patterns that trigger catastrophic backtracking in the regex engine, leading to indefinite CPU saturation. This results in a denial of service condition affecting all users sharing the same Python process. The vulnerability is classified as high severity due to the ease of exploitation and broad impact on availability. The fix is available in NLTK version 3.10.0 and later. Users are advised to upgrade immediately to mitigate the risk.