CVE-2026-80205
NLTK versions before 3.10.0 contain a regular expression denial of service vulnerability in Text.findall() and TokenSearcher.findall() methods that accept user-supplied regular expressions without validation or timeout. Attackers can supply crafted regex patterns that cause catastrophic backtracking, resulting in indefinite CPU saturation and denial of service to all users of the Python process.
Scoring
- Severity
- HIGH
- CVSS base score
- 8.7
- CVSS vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
- EPSS probability
- 0.49%
- CWE
- CWE-1333
- Published
- 2026-08-26
- Last modified
- 2026-09-01
Affected products
- nltk nltk
- nltk nltk
Weakness type
Related vulnerabilities
- CVE-2026-75880 — Apache Artemis, Apache ActiveMQ Artemis: Message selector wildcard handling could lead to denial of service
- CVE-2026-87819 — GitPython before 3.1.60 Denial of Service via ReDoS
- CVE-2026-86081 — n8n: Regular Expression Denial of Service in the Default Blocked-File-Pattern Match via a Git Node Clone Path
- CVE-2026-85062 — Colord: Slow rejection of oversized malformed color strings
- CVE-2026-83619 — xmldom: End-tag Whitespace-Trim Regex ReDoS — quadratic backtracking in the 0.8.x end-tag parser
- CVE-2026-83606 — xmldom PI grammar regex ReDoS: quadratic backtracking on unterminated processing instructions
- CVE-2024-58379 — nodemailer before 6.9.9 ReDoS via attachDataUrls parameter
- CVE-2026-55520 — Protego: Exponential backtracking ReDoS in robots.txt URL wildcard matching