Regular Expression Denial of Service in NLTK by NLTK
CVE-2026-81725

6.3MEDIUM

Key Information:

Vendor

Nltk

Status
Nltk
Vendor
CVE Published:
27 August 2026

What is CVE-2026-81725?

The NLTK library, prior to version 3.10.3, is susceptible to a denial of service attack through its Pl196xCorpusReader component. By supplying malformed TEI blocks that contain numerous unmatched opening tags, attackers can exploit inefficiencies in lazy regex patterns used in the read_block method. This vulnerability can be triggered via public APIs like words() and tagged_words(), causing the system to engage in repeated rescans, which can lead to significant and excessive CPU resource consumption.

Affected Version(s)

nltk 0 < 3.10.3

nltk 3.10.3

References

https://github.com/nltk/nltk/security/advisories/GHSA-8mp...
vendor-advisory
https://www.vulncheck.com/advisories/nltk-before-3.10.3-r...
third-party-advisory

CVSS V4

Score:
6.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.