CVE-2026-80205: NLTK before 3.10.0 ReDoS via Text.findall() unvalidated regex
NLTK versions before 3.10.0 contain a regular expression denial of service vulnerability in Text.findall() and TokenSearcher.findall() methods that accept user-supplied regular expressions without validation or timeout. Attackers can supply crafted regex patterns that cause catastrophic backtracking, resulting in indefinite CPU saturation and denial of service to all users of the Python process.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
NLTKto a version that resolves this vulnerability.Fixed in 3.10.0 - Compensating control
Apply a validation and timeout mechanism for user-supplied regular expressions passed to NLTK Text.findall() and TokenSearcher.findall() (to prevent catastrophic backtracking/indefinite CPU saturation).
Event History
Frequently Asked Questions
Which applications are exposed to this issue?
Applications using NLTK versions before 3.10.0 are exposed when they pass attacker-controlled regular-expression patterns to Text.findall() or TokenSearcher.findall(). The impact is denial of service against the Python process running the affected code.
Does exploitation require authentication or user interaction?
No. The provided vector indicates network-reachable exploitation with low attack complexity, no privileges, and no user interaction, provided an attacker can supply a regex pattern to an affected method.
What is the immediate mitigation if upgrading is not possible?
Do not allow untrusted users to provide arbitrary regular expressions to Text.findall() or TokenSearcher.findall(). Restrict accepted patterns or otherwise validate them before calling these methods, since the affected versions have no regex validation or timeout.
How can I determine whether my deployment is affected?
Check whether the application uses NLTK before version 3.10.0 and whether it calls Text.findall() or TokenSearcher.findall() with regex patterns influenced by external input. Affected executions may show sustained or indefinite CPU consumption in the Python process when processing crafted patterns.