PyPI: nltk

CVE-2026-12061

Safety vulnerability ID: SFTY-20260731-83123

Affected versions of the nltk package are vulnerable to Denial of Service (DoS) due to inefficient regular expression complexity in the FEATURES pattern. The ReviewsCorpusReader class applies the module-level FEATURES regex, whose feature-label sub-pattern is an unbounded, greedy run of word-plus-whitespace groups, causing quadratic backtracking whenever the reviews(), features(), or sents() methods process a line that never reaches a closing bracket.

PythonPyPINVDNVDGitHubGHSA
Created at: Jul 31, 2026Updated at: Jul 31, 2026

Overview

Natural Language Toolkit (NLTK): ReDoS in NLTK ReviewsCorpusReader FEATURES regex

Advisory

nltk – Regular Expression Denial of Service (ReDoS)

Affected Package

Affecting nltk package, versions
<= 3.9.4

Also affects

---

How to Fix

Upgrade
nltk
to
3.10.0
or higher.

Mitigation and Workarounds

---

Vulnerable Functions

Functions linked to known vulnerabilities.

Vulnerable function data is available for Enterprise customers

Book a call with us to see Safety in action.

References

Safety

Verified by Safety

Our Cybersecurity Intelligence Team reviewed this vulnerability. We combine public data with our own research to find issues not yet reported to public sources.

Learn more