HIGH 7.5 GitHub
CVE-2026-12061
Natural Language Toolkit (NLTK): ReDoS in NLTK ReviewsCorpusReader FEATURES regex
### Summary
`ReviewsCorpusReader` extracts feature annotations of the form *label* followed by a bracketed signed digit (e.g. a label then `[+2]`) from each review line, using the module-level `FEATURES` regex. The feature-label sub-pattern is unbounded — an optional greedy run of word-plus-whitespace groups followed by another word, which must then be followed by a literal `[`. On a long bracket-less line the label can match from every search position to the end of the line, causing quadratic b
Affected Products
- pip/nltk <= 3.9.4
References
- https://github.com/advisories/GHSA-fg7f-2386-8897
- https://github.com/nltk/nltk/security/advisories/GHSA-fg7f-2386-8897
- https://github.com/advisories/GHSA-fg7f-2386-8897
This high severity vulnerability with a CVSS score of 7.5 was published on 2026-07-31 via GitHub. Affected: pip/nltk <= 3.9.4.
vulnfeed aggregates 9166 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.