The ReviewsCorpusReader in NLTK uses a module-level FEATURES regex to extract feature annotations formatted as a label followed by a bracketed signed digit (e.g., label[+2]). The label sub-pattern is an unbounded greedy run of word-plus-whitespace groups followed by a word, which must be followed by a literal '['. On input lines that are long sequences of words without brackets, the regex engine performs quadratic backtracking due to repeated failed attempts to match the bracket at each position. This results in O(n²) CPU time relative to the line length, causing the reader functions to hang on a single crafted line. A fix was introduced by bounding the number of word-plus-whitespace groups, reducing the complexity to linear time while preserving extraction correctness on realistic data.

An attacker can cause denial of service by supplying a single crafted review line with a very long sequence of words and no bracketed annotation. Processing this line with ReviewsCorpusReader functions (reviews(), features(), sents()) results in excessive CPU consumption and hanging of the processing thread or process. No authentication or privileges are required, so any user-supplied or untrusted corpus can be used to trigger this condition, potentially stalling multi-tenant pipelines or batch jobs.

A patch is available that introduces a bound on the number of word-plus-whitespace groups in the FEATURES regex, preventing quadratic backtracking. Users should upgrade to NLTK version 3.10.0 or later where this fix is applied. Until patched, avoid processing untrusted or user-supplied review corpora that may contain long bracket-less lines. The vendor advisory confirms a fix is available.