Exponential Backtracking in NLTK TweetTokenizer Due to Unbounded Domain Labels

CVE-2026-72818

What is CVE-2026-72818?

The TweetTokenizer in NLTK is prone to performance issues due to an unbounded naked-domain branch in its URLS regular expression pattern. When processing input with numerous alternating label separators, the tokenizer experiences exponential backtracking, leading to significant delays in processing time for such inputs. This issue arises from the lack of a terminating top-level domain, which causes the tokenizer to explore a vast number of possible partitions before determining a failure. Consequently, services utilizing this tokenizer for untrusted social media text can face unacceptable slowdowns per request, impacting overall application performance.

References