Detections
Analytics

SCA: security update for nltk (GHSA-f8m6-h2c7-8h9x)

high Tenable Self-Hosted Container Security Plugin ID 431710

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - NLTK (Natural Language Toolkit) is a suite of open source Python modules, data sets, and tutorials
 supporting research and development in Natural Language Processing. Versions prior to 3.6.5 are vulnerable
 to regular expression denial of service (ReDoS) attacks. The vulnerability is present in
 PunktSentenceTokenizer, sent_tokenize and word_tokenize. Any users of this class, or these two functions,
 are vulnerable to the ReDoS attack. In short, a specifically crafted long input to any of these vulnerable
 functions will cause them to take a significant amount of execution time. If your program relies on any of
 the vulnerable functions for tokenizing unpredictable user input, then we would strongly recommend
 upgrading to a version of NLTK without the vulnerability. For users unable to upgrade the execution time
 can be bounded by limiting the maximum length of an input to any of the vulnerable functions. Our
 recommendation is to implement such a limit. (CVE-2021-43854)

See Also

https://github.com/advisories/GHSA-f8m6-h2c7-8h9x

Plugin Details

Severity: High

ID: 431710

Version: Revision 1.4

Type: Local

Family: SCA Checks

Published: 8/7/2025

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.18

Vendor

Vendor Severity: High

CVSS v2

Risk Factor: Medium

Base Score: 5

Temporal Score: 3.9

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P

CVSS Score Source: CVE-2021-43854

CVSS v3

Risk Factor: High

Base Score: 7.5

Temporal Score: 6.7

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

CVSS v4

Risk Factor: High

Base Score: 8.7

Threat Score: 7.7

Threat Vector: CVSS:4.0/E:P

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Vulnerability Information

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 1/6/2022

Vulnerability Publication Date: 12/23/2021

Reference Information

CVE: CVE-2021-43854

cwe: CWE-400