NLTK prior to version 3.10.3 processes text via the Pl196xCorpusReader using a lazy regular expression that can be manipulated. By supplying TEI blocks containing many unmatched opening tags, an attacker can force the read_block method to rescan sections repeatedly. This quadratic growth in CPU consumption can eat up workstation or server resources, effectively creating a denial‑of‑service condition. The flaw is a classic case of CWE‑1333, a regular expression denial of service, and a CWE‑400 unbounded resource consumption weakness.

The vulnerability affects the NLTK python library, as identified by the CVE vendor product entry. Any installation of NLTK that is older than version 3.10.3 is potentially exposed. Users who rely on the public interfaces words() or tagged_words() to handle TEI documents are the most at risk.

The CVSS score is 6.3 and the EPSS score is <1%, indicating a moderate severity with very low but non‑zero exploitation probability. The flaw is not listed in the CISA KEV catalog, suggesting no confirmed widespread exploitation yet. Attackers can exploit the weakness by submitting specially crafted TEI content through the standard API endpoints; the attack requires no special privileges and leverages normal library usage, making it accessible to anyone able to feed data into the reader. This flaw combines a CWE‑1333 regular expression denial‑of‑service pattern with a CWE‑400 resource exhaustion.