VDB
CVE-2026-80205
CVE-2026-80205
PUBLISHED
CVSS 8.7 HIGH
Reported by VulnCheck · Published August 26, 2026
NLTK versions before 3.10.0 contain a regular expression denial of service vulnerability in Text.findall() and TokenSearcher.findall() methods that accept user-supplied regular expressions without validation or timeout. Attackers can supply crafted regex patterns that cause catastrophic backtracking, resulting in indefinite CPU saturation and denial of service to all users of the Python process.
Risk Scores
CVSS 4.0
8.7
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| nltk | nltk | 0, 3.10.0 |
| nltk | nltk | 0, 3.10.0 |
| PyPI | nltk | 0 |
Timeline
- Aug 26, 2026 Coalition ESS Score
- Aug 26, 2026 CVE Published
- Aug 27, 2026 EPSS Score
- Sep 1, 2026 EPSS Score
- Sep 2, 2026 EPSS Score
- Sep 2, 2026 Security Advisory
- Sep 6, 2026 EPSS Score
- Sep 9, 2026 EPSS Score
- Sep 12, 2026 EPSS Score
- Sep 16, 2026 EPSS Score
- Sep 18, 2026 EPSS Score
- Sep 24, 2026 EPSS Score
References
- GitHub Security Advisory (GHSA-rrv8-h7p8-rx55) vendor-advisory
- VulnCheck Advisory: NLTK before 3.10.0 ReDoS via Text.findall() unvalidated regex third-party-advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-80205 advisory
- https://github.com/advisories/GHSA-rrv8-h7p8-rx55 advisory
- https://github.com/nltk/nltk/pull/3674 patch
- https://github.com/nltk/nltk/commit/d8e47539317b571ab1422981f5b9653d5eae1249 patch
- https://github.com/nltk/nltk/releases/tag/v3.10.0 url
- https://github.com/pypa/advisory-database/tree/main/vulns/nltk/PYSEC-2026-3750.yaml advisory
- http://www.openwall.com/lists/oss-security/2026/09/01/3 url