CVE-2026-80205

Regex DoS in NLTK ≤3.9 via Text/TokenSearcher findall allowing unchecked regex.

• CVSS 8.7
• 1333
• Input Validation and Sanitization
• Remote

NLTK versions before 3.10.0 contain a regular expression denial of service vulnerability in Text.findall() and TokenSearcher.findall() methods that accept user-supplied regular expressions without validation or timeout. Attackers can supply crafted regex patterns that cause catastrophic backtracking, resulting in indefinite CPU saturation and denial of service to all users of the Python process.

CVE

CVE-2026-80205

CWE

1333

CVSS base score

8.7

Published

2026-08-26

OWASP

A06 Vulnerable and Outdated Components

Orthogonal defect classification

Timing/Serialization

Code defect classification

Timing Issues

Category

Input Validation and Sanitization

Subcategory

Insecure Parsing or Deserialization

Accessibility scope

Remote

Impact

Denial of Service (DoS)

Affected component

NLTK

Fixed by upgrading

Yes

Solution

Upgrade NLTK to version 3.10.0 or later.

import nltk
from nltk.text import Text

def find_matches(tokens, user_regex):
    """
    Returns all matches of a user‑supplied regular expression
    within an NLTK Text object.
    """
    txt = Text(tokens)
    # VULNERABLE: passes user regex directly to NLTK, enabling catastrophic backtracking
    return txt.findall(user_regex)

import nltk
from nltk.text import Text
import regex

def find_matches(tokens, user_regex):
    """
    Returns all matches of a user‑supplied regular expression
    within an NLTK Text object, using a timeout to prevent
    catastrophic backtracking.
    """
    txt = Text(tokens)
    # FIX: compile regex with a timeout and use safe findall
    safe_re = regex.compile(user_regex, timeout=0.5)
    # regex.findall works on strings; join tokens to a single string.
    return safe_re.findall(" ".join(txt))

__VAITP_MODEL_REFUSED__

@misc{vaitp:cve202680205,
  title        = {{Regex DoS in NLTK ≤3.9 via Text/TokenSearcher findall allowing unchecked regex.}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2026},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2026-80205},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2026-80205/}}
}