CVE-2026-72818

Name of the Vulnerable Software and Affected Versions NLTK versions prior to 3.10.1

Description The URLS regular expression in nltk/tokenize/casual.py, which is compiled into TweetTokenizer.WORD RE and used by TweetTokenizer.tokenize, contains an unbounded domain-label prefix. When processing input with many alternating label separators that lacks a trailing top-level domain, the regular expression engine explores an exponential number of partitions, leading to catastrophic backtracking. This results in high CPU consumption, where a few kilobytes of input can stall a single-threaded process for seconds or minutes. This issue affects services using TweetTokenizer or the casual tokenize function to process untrusted social-media text, allowing unauthenticated requests to cause a denial of service.

Recommendations Update to version 3.10.1.