CVE-2026-80206
Received Received - Intake

Regular Expression Denial of Service in NLTK tgrep Module

Publication date: 2026-08-26

Last updated on: 2026-08-26

Assigner: VulnCheck

Description
NLTK before 3.10.3 contains a regular expression denial of service (ReDoS) vulnerability in the tgrep module. The _tgrep_node_action function compiles user-supplied regular expressions embedded in /regex/ pattern nodes and executes them via re.search against tree node labels without any validation or timeout. An attacker who controls the tgrep pattern (e.g., via tgrep_positions() or tgrep_compile() exposed to external input) can supply a pattern that triggers catastrophic backtracking, causing indefinite CPU saturation that blocks the Python process.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-26
Last Modified
2026-08-26
Generated
2026-08-26
AI Q&A
2026-08-26
EPSS Evaluated
N/A
NVD
CVE-2026-80206
EUVD
EUVD-2026-66397

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
nltk nltk to 3.10.3 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-1333 The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

NLTK before 3.10.3 has a ReDoS vulnerability in the tgrep module. The function _tgrep_node_action compiles user-supplied regex patterns without validation and runs them against tree node labels using re.search. Attackers can exploit this by providing patterns that cause catastrophic backtracking, leading to indefinite CPU usage and blocking the Python process.

Detection Guidance

Detect NLTK installations and check for vulnerable versions (before 3.10.3). Use commands like 'pip show nltk' or 'python -c "import nltk; print(nltk.__version__)"' to verify the installed version.

Impact Analysis

This vulnerability can cause denial of service by consuming excessive CPU resources, making applications unresponsive. If an attacker exploits it, your system may slow down or crash, disrupting services that depend on NLTK for text processing.

Mitigation Strategies

Upgrade NLTK to version 3.10.3 or later immediately. Use 'pip install --upgrade nltk' to apply the fix. Review any applications using tgrep functions to ensure they do not accept untrusted input.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-80206. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart