NLTK is 25 years old, with 1.5B+ downloads.
It sits deep in the Python dependency tree including the stack that AI-native applications are built on.
We pointed Kira at it.
It found a high-severity ReDoS vulnerability and autonomously validated that it was exploitable.