The vulnerability exists in NLTK's nltk.text.Text.findall() and TokenSearcher.findall() methods, which accept user-supplied regular expressions and execute them against an internal string without timeout or validation. The preprocessing of the regex does not prevent catastrophic backtracking, enabling ReDoS attacks. An attacker can supply a crafted regex that causes the Python re engine to hang indefinitely, resulting in denial of service. The vulnerability is isolated to the nltk.text module and was patched in commit d8e4753.

An unauthenticated attacker can cause a denial of service by triggering indefinite CPU consumption in any application exposing Text.findall() to external input. This results in service unavailability for legitimate users due to CPU saturation. There is no impact on confidentiality or integrity.

A patch is available and was applied in commit d8e4753. Users should update to the patched version to remediate this vulnerability. No additional mitigation is required if the update is applied.