Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.3
CVE-2026-80205: NLTK before 3.10.0 can be hung by crafted search patterns
CVE-2026-80205 · published 2 months ago
Summary
Versions of the NLTK library older than 3.10.0 let a user supply search patterns that can make the program consume all its CPU, effectively stopping it from responding. This can affect any Python application that uses NLTK’s Text.findall() or TokenSearcher.findall() methods. Upgrade NLTK to version 3.10.0 or later, or add your own checks to limit or validate any user‑provided patterns.
What to do
- Update debian nltk to version 3.10.0-1.
- Update nltk to version 3.10.0.
- Update nltk nltk to version 3.10.0 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Debian:11 | debian | nltk | All versions |
| Debian:12 | debian | nltk | All versions |
| Debian:13 | debian | nltk | All versions |
| Debian:14 | debian | nltk |
< 3.10.0-1 Fix: upgrade to 3.10.0-1
|
| PyPI | – | nltk |
< 3.10.0 Fix: upgrade to 3.10.0
|
| pip | – | nltk |
<= 3.9.4 Fix: upgrade to 3.10.0
|
| – | nltk | nltk | < 3.10.0 |
Original advisory text
NLTK before 3.10.0 ReDoS via Text.findall() unvalidated regex
NLTK versions before 3.10.0 contain a regular expression denial of service vulnerability in Text.findall() and TokenSearcher.findall() methods that accept user-supplied regular expressions without validation or timeout. Attackers can supply crafted regex patterns that cause catastrophic backtracking, resulting in indefinite CPU saturation and denial of service to all users of the Python process.
References
- https://security-tracker.debian.org/tracker/CVE-2026-80205 Vendor Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/80xxx/CVE-2026-80205... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-80205 Vendor Advisory
- https://github.com/nltk/nltk/pull/3674
- https://github.com/nltk/nltk/commit/d8e47539317b571ab1422981f5b9653d5eae1249
- https://github.com/nltk/nltk/releases/tag/v3.10.0
- https://github.com/pypa/advisory-database/tree/main/vulns/nltk/PYSEC-2026-3750.y...
- https://github.com/advisories/GHSA-rrv8-h7p8-rx55
- https://github.com/nltk/nltk Product
- https://github.com/nltk/nltk/security/advisories/GHSA-rrv8-h7p8-rx55 Vendor Advisory
- http://www.openwall.com/lists/oss-security/2026/09/01/3 URL
- https://www.vulncheck.com/advisories/nltk-before-3.10.0-redos-via-text-findall-u... Vendor Advisory
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker partial control
Type
CWE-1333Inefficient Regular Expression Complexity (ReDoS)
Timeline
Published26 Aug 2026
Updated4 Nov 2026
First seen26 Aug 2026
Sources
DEBIAN-CVE-2026-80205 · OSV
CVE-2026-80205 · NVD
CVE-2026-80205 · MITRE
CVE-2026-80205 · OSV
GHSA-rrv8-h7p8-rx55 · GHSA
GHSA-rrv8-h7p8-rx55 · OSV
Track software like this
Free during beta