NLTK: ReDoS in nltk.tgrep via unvalidated user-supplied regular expressions
NLTK: ReDoS in nltk.tgrep via unvalidated user-supplied regular expressions. The NLTK tgrep module accepts user-supplied regular expressions and passes them to the Python re engine without a timeout or validation, enabling catastrophic backtracking (ReDoS).
- Severity
- MediumCVSS 3.1 · 5.9
- Fix
- Fixed in 3.10.3
- Affected versions
- before 3.10.3
- Weakness
- CWE-1333Inefficient Regular Expression Complexity (ReDoS)
- Exploit likelihood
- 0.26% in 30 daysEPSS, higher than 18% of known flaws
- Affects
- NLTK
What to do
Update to 3.10.3 or later.
Severity breakdown
- Attack vector Network Requires network access to the vulnerable service
- Attack complexity High Attack depends on conditions outside the attacker's control
- Privileges required None Attacker needs no account or login
- User interaction None No victim action needed
- Scope Unchanged Impact stays within the same security authority
- Confidentiality impact None No data disclosure
- Integrity impact None No data tampering
- Availability impact High The service can stop or suffer serious disruption
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H Open in FIRST.org calculatorReferences
- github.com · v3.10.3 (tag) patch release notes
- github.com · GHSA-w3v8-gmh9-3wv7 vendor advisory
- nvd.nist.gov · CVE-2026-80206 vdb entry
- euvd.enisa.europa.eu · EUVD-2026-66397 vdb entry
- github.com · commit 0072ea2 GitHub Advisory
- github.com · PYSEC-2026-3751.yaml (main) GitHub Advisory
- vulncheck.com · nltk-3.10.2-regular-expression-denial-of-service-via-tgrep GitHub Advisory