| Package | Affected versions | Patched versions |
|---|---|---|
| nltk | < 3.6.4 | 3.6.4 |
| nltk | ≤ 3.6.3 |
The nltk package is vulnerable to ReDoS (regular expression denial of service). An attacker that is able to provide as an input to the [_read_comparison_block()(https://github.com/nltk/nltk/blob/23f4b1c4b4006b0cb3ec278e801029557cec4e82/nltk/corpus/reader/comparative_sents.py#L259) function in the file nltk/corpus/reader/comparative_sents.py may cause an application to consume an excessive amount of CPU.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free