CVE-2026-81725

Name of the Vulnerable Software and Affected Versions NLTK versions prior to 3.10.3

Description A regular expression denial of service exists in Pl196xCorpusReader. An attacker can cause quadratic CPU consumption by providing malformed TEI (Text Encoding Initiative) blocks containing numerous unmatched opening tags. This is achieved by exploiting lazy regex patterns within the read block() function, which can be triggered via public APIs such as words() and tagged words(), forcing repeated rescans and resulting in near-quadratic runtime growth.

Recommendations Update NLTK to version 3.10.3 or later. As a temporary mitigation, restrict the use of the read block() function or the words() and tagged words() APIs when processing untrusted TEI blocks.