PyPI: nltk

CVE-2021-3828

Safety vulnerability ID: SFTY-20210927-85995

Safety legacy ID: pyup.io-54696

Nltk before 3.6.4 is vulnerable to Inefficient Regular Expression Complexity.

PyPI

NVD

GHSA

Created at: Jul 5, 2026Updated at: Jul 5, 2026

Overview

NLTK Vulnerable to REDoS

Advisory

Nltk before 3.6.4 is vulnerable to Inefficient Regular Expression Complexity.

Affected Package

Affecting nltk package, versions>=0,<3.6.4

Also affects

---

How to Fix

Upgradenltkto3.6.4or higher.

Mitigation and Workarounds

---

Vulnerable Functions

Functions linked to known vulnerabilities.

Vulnerable function data is available for Enterprise customers

Book a call with us to see Safety in action.

References

https://getsafety.com/vulnerabilities/SFTY-20210927-85995/CVE-2021-3828
https://nvd.nist.gov/vuln/detail/CVE-2021-3828
https://github.com/nltk/nltk/pull/2816
https://github.com/nltk/nltk/commit/277711ab1dec729e626b27aab6fa35ea5efbd7e6
https://huntr.dev/bounties/d19aed43-75bc-4a03-91a0-4d0bb516bc32
https://github.com/advisories/GHSA-2ww3-fxvq-293j
https://github.com/pypa/advisory-database/tree/main/vulns/nltk/PYSEC-2021-356.yaml

Verified by Safety

Our Cybersecurity Intelligence Team reviewed this vulnerability. We combine public data with our own research to find issues not yet reported to public sources.

Learn more