NLTK versions before 3.10.3 are vulnerable to a ReDoS condition in the tgrep module. The internal function that compiles user‑supplied regular expressions does not enforce validation or apply a timeout when matching tree node labels, allowing an attacker to supply a crafted pattern that triggers catastrophic backtracking. The resulting excessive CPU consumption can stall the entire Python process, effectively denying service to legitimate users.

The vulnerability exists in the NLTK library, specifically before version 3.10.3. Systems that import nltk and use the tgrep functionality, particularly via the exposed tgrep_positions() or tgrep_compile() interfaces, are susceptible. All deployments of NLTK 3.10.2 or earlier that incorporate these features should be reviewed.

The CVSS score of 8.2 classifies this as High severity. EPSS data is not available, and it is not listed in CISA's KEV catalog, but the lack of mitigation in the library means the vulnerability can be exploited in any environment where an attacker can provide input to the tgrep functions. The primary vector is local or remote code that can invoke these functions with crafted patterns, leading to prolonged CPU usage and potential denial of service.