Résumé
Duplicate Advisory: ReDoS in nltk.tgrep via unvalidated user-supplied regular expressions
Détails de l’avis
Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-w3v8-gmh9-3wv7. This link is maintained to preserve external references.
Original Description
NLTK before 3.10.3 contains a regular expression denial of service (ReDoS) vulnerability in the tgrep module. The _tgrep_node_action function compiles user-supplied regular expressions embedded in /regex/ pattern nodes and executes them via re.search against tree node labels without any validation or timeout. An attacker who controls the tgrep pattern (e.g., via tgrep_positions() or tgrep_compile() exposed to external input) can supply a pattern that triggers catastrophic backtracking, causing indefinite CPU saturation that blocks the Python process.
Références
Vulnérabilités liées
Tout Supply chain →- MEDIUMCVE-2026-73556
vLLM: ReDoS via structured_outputs.regex in the lm-format-enforcer backend (no compile timeout) — missed sibling of GHSA-rwxx-mrjm-wc2m
- HIGHGHSA-j8pm-gj4c-rq4x
league/commonmark: Denial of service via crafted code fences, reference links, and emphasis delimiters
- HIGHCVE-2026-55520
Protego has exponential backtracking ReDoS in robots.txt URL wildcard matching
- HIGHCVE-2026-57584
Phalcon: Catastrophic backtracking (ReDoS) in the default Phalcon Router route lead to remote unauthenticated DoS
- HIGHCVE-2026-59893
sqlparse: Inefficient Regex Handling of Dollar-Quoted SQL Literals Leads to ReDoS (Denial of Service)
- HIGHCVE-2026-54284
sqlparse: TokenList.__init__ materializes O(subtree) value per group, causing CPU DoS before depth/token caps trigger