NLTK library versions earlier than 3.10.0 contain a regular expression denial of service (ReDoS) vulnerability (CWE-1333) in the Text.findall() and TokenSearcher.findall() methods. These methods accept arbitrary regular expressions supplied by the user without validation or a timeout. When an attacker supplies a complex or malicious regex pattern, the engine performs catastrophic backtracking, leading to prolonged or indefinite CPU usage and ultimately a denial of service for the entire Python process.

Any deployment that includes the NLTK library before version 3.10.0 is affected. This includes Python scripts, web applications, data processing pipelines, or any service that utilizes NLTK’s Text module. All environments running Python with an impacted NLTK version are potentially vulnerable.

The CVSS score of 8.7 indicates high severity. No EPSS score is available, leaving exploitation probability uncertain. The vulnerability is not listed in the CISA KEV catalog. An attacker must supply a crafted regex; therefore the attack vector is local or any interface that feeds user‑controlled text into NLTK’s findall functionality. Because the flaw causes CPU exhaustion, compromising service availability is straightforward once a complex pattern is executed, but no privilege escalation occurs.