CVE-2026-80206 Overview
CVE-2026-80206 is a Regular Expression Denial of Service (ReDoS) vulnerability in the Natural Language Toolkit (NLTK) library before version 3.10.3. The flaw resides in the tgrep module, where the _tgrep_node_action function compiles user-supplied regular expressions embedded in /regex/ pattern nodes and executes them via re.search against tree node labels. NLTK performs no validation and enforces no execution timeout. An attacker who controls the tgrep pattern can supply input that triggers catastrophic backtracking, saturating CPU and blocking the Python process indefinitely. The vulnerability is tracked as CWE-1333: Inefficient Regular Expression Complexity.
Critical Impact
Remote, unauthenticated attackers can cause sustained CPU exhaustion in any application exposing tgrep_positions() or tgrep_compile() to external input, disrupting availability of NLP services.
Affected Products
- NLTK versions prior to 3.10.3
- Python applications invoking tgrep_positions() with untrusted pattern input
- Python applications invoking tgrep_compile() with untrusted pattern input
Discovery Timeline
- 2026-08-26 - CVE-2026-80206 published to NVD
- 2026-08-26 - Last updated in NVD database
Technical Details for CVE-2026-80206
Vulnerability Analysis
NLTK's tgrep module implements a domain-specific query language for matching patterns against syntactic tree structures. Query strings can embed regular expressions between forward slashes, for example /^NP.*/, which the parser extracts and passes to Python's re module. The _tgrep_node_action function compiles the extracted regex and executes re.search against tree node labels during matching.
The module accepts arbitrary regex syntax without complexity analysis, ambiguity detection, or execution deadlines. When an attacker supplies a pattern containing nested quantifiers or overlapping alternations against a crafted input string, Python's backtracking regex engine explores an exponential number of match paths. CPU time grows non-linearly with input length, blocking the interpreter thread until manually terminated.
Root Cause
The root cause is unbounded evaluation of attacker-controlled regular expressions inside _tgrep_node_action. The function trusts pattern content, delegates directly to re.search, and does not wrap execution in a subprocess or watchdog. Because Python's default regex engine is not RE2-compatible, patterns exhibiting catastrophic backtracking run until the process is killed.
Attack Vector
Exploitation requires that the application expose tgrep_positions() or tgrep_compile() to external input, such as a web endpoint that lets users search parsed corpora with tgrep queries. The attacker submits a pathological pattern (for example, nested quantifiers like (a+)+$ matched against a long string of a characters followed by a non-matching suffix). The single request consumes a CPU core indefinitely, and repeated requests exhaust worker capacity. Refer to the GitHub Security Advisory GHSA-w3v8-gmh9-3wv7 and the VulnCheck Advisory for pattern details.
Detection Methods for CVE-2026-80206
Indicators of Compromise
- Python worker processes pinned at 100% CPU for extended periods with no progress in application logs
- Long-running HTTP requests to endpoints that accept tgrep query strings, followed by timeouts or worker restarts
- Stack traces or py-spy dumps showing threads blocked inside sre_parse or _tgrep_node_action
Detection Strategies
- Inventory Python dependencies with pip list or SBOM tooling and flag any nltk version below 3.10.3
- Perform static code review for calls to tgrep_positions, tgrep_compile, or TgrepException handling that accept untrusted input
- Add application-level metrics that record execution time of tgrep queries and alert on outliers exceeding a fixed threshold
Monitoring Recommendations
- Track per-request CPU consumption on services exposing NLP query interfaces and alert when a single request exceeds baseline
- Monitor process-level runtime with tools such as py-spy or perf to catch threads stuck in regex evaluation
- Correlate web access logs with worker CPU spikes to identify malicious query patterns for blocklisting
How to Mitigate CVE-2026-80206
Immediate Actions Required
- Upgrade NLTK to version 3.10.3 or later on all systems that import the library
- Audit application code paths that pass user input into tgrep_positions() or tgrep_compile() and disable them until patched
- Enforce request-level CPU or wall-clock timeouts on any endpoint exposing tgrep functionality
Patch Information
The issue is fixed in NLTK 3.10.3. Consult the GitHub Security Advisory GHSA-w3v8-gmh9-3wv7 for the upstream patch details and the VulnCheck advisory for exploitation context.
Workarounds
- Pin NLTK to 3.10.3 or newer in requirements.txt and rebuild application containers
- Reject or sanitize tgrep query inputs that contain /.../ regex nodes, or restrict callers to a hardcoded pattern allowlist
- Execute tgrep queries in a separate worker process with a hard CPU limit using resource.setrlimit(resource.RLIMIT_CPU, ...)
- Place tgrep-backed endpoints behind a reverse-proxy timeout and per-client rate limit to contain abuse
# Upgrade NLTK to the patched release
pip install --upgrade 'nltk>=3.10.3'
python -c "import nltk; print(nltk.__version__)"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
