CVE-2026-80205
High · 7.5CVSS
7.5
EPSS
0.7%
Published
Aug 26, 2026
CISA due date
—
The record
NLTK versions before 3.10.0 contain a regular expression denial of service vulnerability in Text.findall() and TokenSearcher.findall() methods that accept user-supplied regular expressions without validation or timeout. Attackers can supply crafted regex patterns that cause catastrophic backtracking, resulting in indefinite CPU saturation and denial of service to all users of the Python process.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-80206 NLTK before 3.10.3 contains a regular expression denial of service (ReDoS) vulnerability… CWE-1333
- CVE-2026-79770 Nokogiri versions before 1.19.3 contain regular expression denial of service… CWE-1333
- CVE-2026-72818 The URLS regular expression in nltk/tokenize/casual.py, compiled into… CWE-1333
- CVE-2026-59893 sqlparse is a non-validating SQL parser module for Python. CWE-1333
- CVE-2026-54284 sqlparse is a non-validating SQL parser module for Python. CWE-1333
- CVE-2026-69207 Hono is a Web application framework that provides support for any JavaScript runtime. CWE-1333
- CVE-2026-14741 HTTP::Date versions before 6.08 for Perl allow CPU exhaustion via polynomial regex… CWE-1333
- CVE-2026-49477 Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4. CWE-1333