Regular Expression Denial of Service Vulnerability in NLTK by Community

CVE-2026-80206

What is CVE-2026-80206?

NLTK versions before 3.10.3 contain a vulnerability in the tgrep module, where user-supplied regular expressions can lead to Regular Expression Denial of Service (ReDoS). The issue arises from the _tgrep_node_action function that compiles and executes these expressions without proper validation or timeout, allowing attackers to exploit this flaw by crafting patterns that cause catastrophic backtracking. This can result in excessive CPU usage, effectively blocking the Python process and degrading performance.

References