NLTK: ReDoS in nltk.tgrep via unvalidated user-supplied regular expressions

Published September 8, 2026 CVE-2026-80206

NLTK: ReDoS in nltk.tgrep via unvalidated user-supplied regular expressions. The NLTK tgrep module accepts user-supplied regular expressions and passes them to the Python re engine without a timeout or validation, enabling catastrophic backtracking (ReDoS).

Severity
MediumCVSS 3.1 · 5.9
Fix
Fixed in 3.10.3
Affected versions
before 3.10.3
Weakness
CWE-1333Inefficient Regular Expression Complexity (ReDoS)
Exploit likelihood
0.26% in 30 daysEPSS, higher than 18% of known flaws
Affects
NLTK

What to do

Update to 3.10.3 or later.

Severity breakdown

  • Attack vector Network Requires network access to the vulnerable service
  • Attack complexity High Attack depends on conditions outside the attacker's control
  • Privileges required None Attacker needs no account or login
  • User interaction None No victim action needed
  • Scope Unchanged Impact stays within the same security authority
  • Confidentiality impact None No data disclosure
  • Integrity impact None No data tampering
  • Availability impact High The service can stop or suffer serious disruption
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H Open in FIRST.org calculator