NLTK up to 3.10.0 TweetTokenizer nltk/tokenize/casual.py TweetTokenizer.tokenize incorrect regex

Summaryinfo

A vulnerability was found in NLTK up to 3.10.0. It has been rated as problematic. This affects the function TweetTokenizer.tokenize of the file nltk/tokenize/casual.py of the component TweetTokenizer. This manipulation causes incorrect regex. This vulnerability is tracked as CVE-2026-72818. The attack is possible to be carried out remotely. No exploit exists.

Detailsinfo

A vulnerability classified as problematic was found in NLTK up to 3.10.0. Affected by this vulnerability is the function TweetTokenizer.tokenize of the file nltk/tokenize/casual.py of the component TweetTokenizer. The manipulation with an unknown input leads to a incorrect regex vulnerability. The CWE definition for the vulnerability is CWE-185. The product specifies a regular expression in a way that causes data to be improperly matched or compared. As an impact it is known to affect availability. The summary by CVE is:

The URLS regular expression in nltk/tokenize/casual.py, compiled into TweetTokenizer.WORD_RE and applied by TweetTokenizer.tokenize, contains a naked-domain branch whose domain-label prefix [a-z0-9]+(?:[.\-][a-z0-9]+)* is unbounded. Input consisting of many alternating label separators can be partitioned in exponentially many ways, and because the branch also requires a trailing top-level domain that such input never supplies, the engine explores those partitions before failing at each offset. A few kilobytes of input therefore consumes seconds to minutes of single-threaded CPU, and the HANG_RE substitution performed before matching does not collapse the pattern. TweetTokenizer is intended for tokenizing untrusted social-media text, so any service that applies it, or the module-level casual_tokenize, to submitted text can be stalled per request without authentication. Version 3.10.1 bounds the label repetition.

It is possible to read the advisory at github.com. This vulnerability is known as CVE-2026-72818 since 08/10/2026. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. Technical details of the vulnerability are known, but there is no available exploit.

Upgrading to version 3.10.1 eliminates this vulnerability.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Name

• NLTK

Version

• 3.0
• 3.1
• 3.2
• 3.3
• 3.4
• 3.5
• 3.6
• 3.7
• 3.8
• 3.9
• 3.10.0

Website

• Product: https://github.com/nltk/nltk/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion