CVE-2026-80205: NLTK Regular Expression DOS Vulnerability

CVE-2026-80205 Overview

CVE-2026-80205 is a regular expression denial of service (ReDoS) vulnerability in the Natural Language Toolkit (NLTK) affecting versions before 3.10.0. The Text.findall() and TokenSearcher.findall() methods accept user-supplied regular expressions without validation or execution timeout. An attacker who can influence the regex input can supply a crafted pattern that triggers catastrophic backtracking. The resulting CPU saturation blocks the Python process indefinitely and denies service to all users sharing that process.

Critical Impact
A single malicious regex pattern causes indefinite CPU exhaustion in the host Python process, blocking all concurrent NLTK users.

Affected Products

NLTK versions prior to 3.10.0
Python applications embedding NLTK Text.findall() with untrusted input
Python applications embedding NLTK TokenSearcher.findall() with untrusted input

Discovery Timeline

2026-08-26 - CVE-2026-80205 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-80205

Vulnerability Analysis

The flaw is classified as an inefficient regular expression complexity issue [CWE-1333]. NLTK's Text.findall() and TokenSearcher.findall() compile regex patterns received from callers and execute them against tokenized corpora. Neither method sanitizes the pattern nor imposes an execution deadline. A pattern containing nested quantifiers or overlapping alternations can exhibit exponential matching time against attacker-chosen inputs.

Because CPython holds the Global Interpreter Lock during regex evaluation, a single runaway match monopolizes the interpreter thread. Web services, batch pipelines, and notebooks that expose NLTK search to network callers all inherit this exposure. The issue does not corrupt memory or leak data. It denies availability of the process. The VA:H component of the vector reflects this availability-only impact.

Root Cause

The root cause is passing untrusted input directly into Python's re engine without validation, pattern complexity limits, or timeout enforcement. Python's default regex engine is backtracking-based and does not cap match time. Patterns such as (a+)+$ evaluated against a long non-matching string produce catastrophic backtracking. NLTK's public search API exposed this behavior through methods documented for interactive use but reachable from server contexts.

Attack Vector

Exploitation requires no authentication and no user interaction. An attacker submits a crafted regex through any application interface that forwards search input to Text.findall() or TokenSearcher.findall(). The Python process consumes CPU indefinitely until the operator terminates it. Refer to the GitHub Security Advisory GHSA-rrv8-h7p8-rx55 and the VulnCheck Advisory for NLTK for exploitation details.

Detection Methods for CVE-2026-80205

Indicators of Compromise

Python worker processes pinned at 100% CPU on a single core with no forward progress in application logs.
Repeated inbound requests containing regex metacharacters targeting NLTK search endpoints.
Increased request timeout rates or worker recycling in WSGI or ASGI application logs.

Detection Strategies

Inventory Python environments for nltk versions below 3.10.0 using pip list or software bill of materials tooling.
Perform static code review for call sites of Text.findall and TokenSearcher.findall that accept external input.
Add web application firewall rules that flag request parameters containing high-risk regex constructs such as nested quantifiers.

Monitoring Recommendations

Alert on sustained per-process CPU saturation combined with stalled request queues on services that load NLTK.
Log the source and content of regex patterns passed into NLTK search methods for retrospective analysis.
Track NLTK package versions across build pipelines and container images to detect drift below 3.10.0.

How to Mitigate CVE-2026-80205

Immediate Actions Required

Upgrade NLTK to version 3.10.0 or later in all Python environments.
Audit application code for exposure of Text.findall() and TokenSearcher.findall() to untrusted callers.
Restrict the NLTK search endpoints to authenticated users until the upgrade is deployed.

Patch Information

Upgrade to NLTK 3.10.0 or later. The maintainers documented the fix in the GitHub Security Advisory GHSA-rrv8-h7p8-rx55. Update pinned dependency files, rebuild affected container images, and redeploy all services that import NLTK.

Workarounds

Reject caller-supplied regex input at the application boundary and offer a fixed set of pre-validated patterns.
Execute NLTK search calls in a subprocess with a hard CPU or wall-clock limit enforced via resource.setrlimit or a supervisor.
Wrap regex evaluation with the third-party regex module using its timeout argument instead of routing user patterns through Text.findall().

bash

# Configuration example
pip install --upgrade 'nltk>=3.10.0'
pip show nltk | grep -i version