Inefficient regular expression complexity in Natural Language Toolkit - #VU142772
Published: August 15, 2026
Vulnerability identifier: #VU142772
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-1333
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to inefficient regular expression complexity in nltk.text.Text.findall() and nltk.text.TokenSearcher.findall() when processing user-supplied regular expressions. A remote attacker can send a specially crafted regular expression to cause a denial of service.
The issue is isolated to the nltk.text module and can result in indefinite CPU saturation through catastrophic backtracking in the Python re engine.
Affected software
Natural Language Toolkit
Remediation
Install security update from vendor's website.
Natural Language Toolkit - update to 3.10.0