Threats tagged 'ghsa-fg7f-2386-8897'

CVE-2026-12061 is a Regular Expression Denial of Service (ReDoS) vulnerability in the Natural Language Toolkit (NLTK) ReviewsCorpusReader component used by the gptline product. The vulnerability arises from an unbounded greedy regex pattern in the FEATURES regex, which extracts feature annotations from review lines. When processing a long bracket-less line, the regex causes quadratic backtracking, leading to excessive CPU consumption and hanging the processing thread. This can be exploited by an attacker supplying a crafted review line to cause denial of service without requiring authentication or privileges. A patch is available that bounds the regex to prevent the quadratic behavior while preserving correct extraction on legitimate input.