CVE-2026-12061

Name of the Vulnerable Software and Affected Versions NLTK (affected versions not specified)

Description ReviewsCorpusReader is susceptible to a Regular Expression Denial of Service (ReDoS) when extracting feature annotations. The issue occurs because the FEATURES regex uses an unbounded greedy pattern to match labels. When processing a long line that lacks the expected bracketed signed digit (e.g., [+2]), the engine performs quadratic backtracking, attempting to match the label from every possible starting position to the end of the line. This can lead to a denial of service, hanging the reviews(), features(), and sents() functions. For instance, a single crafted line containing approximately 100,000 words can consume CPU resources for several seconds or minutes, stalling the calling thread or process.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.