# CVE-2026-72818

## Summary

- **CVE ID:** CVE-2026-72818
- **Severity:** HIGH
- **CVSS Score:** 8.7 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N)
- **CWE:** CWE-1333
- **Published:** Aug 20, 2026
- **Last Modified:** Aug 21, 2026

## Description

The URLS regular expression in nltk/tokenize/casual.py, compiled into TweetTokenizer.WORD_RE and applied by TweetTokenizer.tokenize, contains a naked-domain branch whose domain-label prefix [a-z0-9]+(?:[.\-][a-z0-9]+)* is unbounded. Input consisting of many alternating label separators can be partitioned in exponentially many ways, and because the branch also requires a trailing top-level domain that such input never supplies, the engine explores those partitions before failing at each offset. A few kilobytes of input therefore consumes seconds to minutes of single-threaded CPU, and the HANG_RE substitution performed before matching does not collapse the pattern. TweetTokenizer is intended for tokenizing untrusted social-media text, so any service that applies it, or the module-level casual_tokenize, to submitted text can be stalled per request without authentication. Version 3.10.1 bounds the label repetition.

## Affected Products

- nltk — nltk (0)
- nltk — nltk (3.10.1)

## References

- [CNA](https://github.com/nltk/nltk/issues/3704)
- [CNA](https://github.com/nltk/nltk/blob/3.9.4/nltk/tokenize/casual.py)
- [CNA](https://github.com/nltk/nltk/releases/tag/v3.10.1)
- [CNA](https://github.com/nltk/nltk)
- [CNA](https://www.vulncheck.com/advisories/nltk-tweettokenizer-url-pattern-backtracks-catastrophically-on-naked-domain-like-input)

## Exploitation Prediction (EPSS)

- **EPSS Score:** 0.51%
- **EPSS Percentile:** 41.5

---
_Exported from OnDuty AI Vulnerability Intelligence on 2026-09-11._