Regular Expression Denial of Service in NLTK by the Vendor NLTK

CVE-2026-80205

What is CVE-2026-80205?

NLTK versions prior to 3.10.0 are susceptible to a regular expression denial of service vulnerability, primarily affecting the Text.findall() and TokenSearcher.findall() methods. This vulnerability arises from the acceptance of user-supplied regular expressions without proper validation or timeout mechanisms. Attackers can exploit this flaw by submitting specially crafted regex patterns that induce catastrophic backtracking. Consequently, this can lead to excessive CPU usage, severely impacting the performance of the Python process and resulting in denial of service for all users.

References