CVE-2026-80206

Name of the Vulnerable Software and Affected Versions NLTK versions prior to 3.10.3

Description The tgrep module contains a regular expression denial of service (ReDoS) issue. The tgrep node action() function compiles user-supplied regular expressions within /regex/ pattern nodes and executes them using re.search against tree node labels without validation or timeouts. An attacker controlling the tgrep pattern, such as through tgrep positions() or tgrep compile() exposed to external input, can provide a pattern that triggers catastrophic backtracking—a condition where the regex engine takes an exponential amount of time to process a string—leading to indefinite CPU saturation and blocking the Python process.

Recommendations Update to version 3.10.3 or later. As a temporary mitigation, restrict external input to the tgrep positions() and tgrep compile() functions.