CVE-2026-81725: NLTK before 3.10.3 Regular Expression Denial of Service via Pl196xCorpusReader
NLTK before 3.10.3 contains a regular expression denial of service vulnerability in Pl196xCorpusReader that allows attackers to cause quadratic CPU consumption by supplying malformed TEI blocks with many unmatched opening tags. Attackers can exploit lazy regex patterns in the readblock method through public APIs like words() and taggedwords() to force repeated rescans and achieve near-quadratic runtime growth.
Affected Software
Event History
Frequently Asked Questions
Which NLTK versions are affected?
NLTK versions before 3.10.3 are affected. Version 3.10.3 is not identified as affected by the provided information.
What must an attacker be able to do to trigger the issue?
An attacker must be able to supply malformed TEI blocks containing many unmatched opening tags to code that processes them through Pl196xCorpusReader. The vulnerable parsing behavior can be reached through public APIs including words() and tagged_words().
What is the expected impact of successful exploitation?
Successful exploitation causes excessive CPU consumption through repeated regular-expression rescans, with near-quadratic runtime growth. The provided severity vector indicates an availability impact and does not indicate confidentiality or integrity impact.