NLTK up to 3.9.x Regular Expression Text.findall/TokenSearcher.findall redos

Summaryinfo

A vulnerability classified as problematic has been found in NLTK up to 3.9.x. This issue affects the function Text.findall/TokenSearcher.findall of the component Regular Expression. Performing a manipulation results in redos. This vulnerability is identified as CVE-2026-80205. The attack can be initiated remotely. There is not any exploit available.

Detailsinfo

A vulnerability, which was classified as problematic, was found in NLTK up to 3.9.x. This affects the function Text.findall/TokenSearcher.findall of the component Regular Expression. The manipulation with an unknown input leads to a redos vulnerability. CWE is classifying the issue as CWE-1333. The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles. This is going to have an impact on availability. The summary by CVE is:

NLTK versions before 3.10.0 contain a regular expression denial of service vulnerability in Text.findall() and TokenSearcher.findall() methods that accept user-supplied regular expressions without validation or timeout. Attackers can supply crafted regex patterns that cause catastrophic backtracking, resulting in indefinite CPU saturation and denial of service to all users of the Python process.

It is possible to read the advisory at github.com. This vulnerability is uniquely identified as CVE-2026-80205 since 08/26/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Technical details of the vulnerability are known, but there is no available exploit. The attack technique deployed by this issue is T1449.003 according to MITRE ATT&CK.

Upgrading to version 3.10.0 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-66396). Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Name

• NLTK

Version

• 3.0
• 3.1
• 3.2
• 3.3
• 3.4
• 3.5
• 3.6
• 3.7
• 3.8
• 3.9

Website

• Product: https://github.com/nltk/nltk/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion