Inefficient regular expression complexity in Natural Language Toolkit - CVE-2026-80205
Published: August 15, 2026 / Updated: September 14, 2026
Vulnerability identifier: #VU142772
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-80205
CWE-ID: CWE-1333
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to inefficient regular expression complexity in nltk.text.Text.findall() and nltk.text.TokenSearcher.findall() when processing user-supplied regular expressions. A remote attacker can send a specially crafted regular expression to cause a denial of service.
The issue is isolated to the nltk.text module and can result in indefinite CPU saturation through catastrophic backtracking in the Python re engine.
Affected software
Natural Language Toolkit
How to mitigate CVE-2026-80205
Install security update from vendor's website.
Natural Language Toolkit - update to 3.10.0